A method and system for security isolation of 5G network slices

Abstract

The application relates to the field of 5G communication technology, and discloses a 5G network slice security isolation method and system.The 5G physical network is divided into multiple independent slices, each slice contains an access node, a core node and an output node, the access node is used for security authentication, the terminal matching index is dynamically calculated based on terminal state parameters and authentication matching times; the core node is used for a security management module, the flow security index is obtained based on the weighted comparison of the current flow and a reference value and historical flow; the output node is used for security evaluation, the output security index is obtained by the weighted comparison of the current communication times and a reference value and historical times; the access, flow and output indexes are compared with corresponding threshold values; if any one is abnormal, the current slice is directly isolated; the deviation of each security index and the threshold value is weighted calculated and compared with the threshold value; if greater than or equal to the corresponding threshold value, the current slice is isolated, multi-dimensional security isolation of the 5G network slice is realized, and the balance between precision and calculation efficiency is achieved.

Description

A secure isolation method and system for 5G network slicing Technical Field

[0001] This invention relates to the field of 5G communication technology, and specifically to a secure isolation method and system for 5G network slicing. Background Technology

[0002] 5G networks, with their high speed, low latency, and large capacity, have been widely used in various fields. Network slicing technology, as one of the key technologies of 5G networks, can divide the physical network into multiple virtual, isolated logical network slices according to different service needs. Each slice can be independently configured with resources, managed, and operated to meet the requirements of different service scenarios for network performance, security, and other aspects.

[0003] The issue of secure isolation between network slices is becoming increasingly prominent. If the isolation mechanism between slices is not perfect, it may lead to security risks such as data leakage, unauthorized access, and malicious attacks. However, traditional isolation methods rely on only a single dimension (such as traffic monitoring) for security assessment, which is insufficient to deal with complex security threats (such as attacks that combine terminal vulnerabilities with malicious traffic). Therefore, there is an urgent need for a more effective 5G network slice security isolation method and system. Summary of the Invention

[0004] The purpose of this invention is to provide a secure isolation method and system for 5G network slicing, thereby solving the aforementioned technical problems.

[0005] A secure isolation method for 5G network slicing, the method comprising the following steps:

[0006] Step S1: Divide the 5G physical network into multiple independent network slices, each network slice including access nodes, core nodes and output nodes;

[0007] Step S2: Set up a security authentication module at the access node of each network slice to perform security authentication on the access terminal;

[0008] Step S3: Set up a security management module at the core node of each network slice to analyze data traffic, extract the characteristics of the data traffic, and determine whether it is malicious attack traffic based on the characteristics.

[0009] Step S4: Set up a security assessment module at the output node of each network slice to perform a security assessment on the output status;

[0010] Step S5: Determine the security isolation of each network slice based on the characteristics of the access terminal, data traffic, and communication objects.

[0011] As a further description of the present invention, the working process of step S2 includes:

[0012] Obtain the status parameters of the access terminal, and extract the overall state security factor μ of the access terminal based on the status parameters. S ;

[0013] Obtain the matching parameters of the access terminal, and extract the overall matching security factor M of the access terminal based on the matching parameters. S ;

[0014] The overall state security factor μ of the access terminal S The overall matching security factor M with the access terminal S Substituting into the following formula, σ=α*μ S +β*M S Calculate the security index σ of the access terminal;

[0015] Compare the access terminal security indicator σ with the system-set access terminal security indicator σ0. If σ is greater than or equal to σ0, it indicates that the access terminal security status is abnormal; otherwise, it indicates that the access terminal security status is normal.

[0016] As a further description of the present invention, the process of extracting the state security coefficient of the access terminal includes:

[0017] Construct the state parameter matrix of the access terminal. The matrix expression is as follows:

[0018]

[0019] Construct the state parameter coefficient matrix of the access terminal. The matrix expression is as follows:

[0020] β=[k A k B k C k D k E k F ];

[0021] In the formula, A represents the operating system update status, B represents whether the firewall is enabled, C represents whether antivirus software is installed, D represents the number of device vulnerabilities, E represents authentication strength, and F represents the existence of the hardware trusted platform module; the elements in the β matrix are the weight coefficients corresponding to A, B, C, D, E, and F, respectively. max To allow the maximum number of vulnerabilities, E max The strongest authentication strength;

[0022] Construct a mathematical model for the security coefficient of the access terminal state, expressed as: μ=α*β T ;

[0023] Obtain the number of access terminals n, and calculate the state security coefficient of each of the n access terminals sequentially according to the mathematical model of access terminal state security coefficient, using the formula. The overall state security factor of the access terminal is calculated, where i belongs to n, and μ i Let μ be the state security coefficient of the i-th access terminal. th The reference value for the safety factor set for the system;

[0024] If the operating system status of the access terminal has been updated, A=1; if it has expired, A=0; if the access terminal has a firewall enabled, B=1; if it has not enabled, B=0; if the access terminal has antivirus software installed, C=1; if it has not installed, C=0; if the hardware trusted platform module exists, F=1; if it does not exist, F=0.

[0025] As a further description of the present invention, the process of extracting the matching security coefficient of the access terminal includes:

[0026] The matching degree of n access terminals is obtained in sequence. The matching degree is 1 for one successful match, 1 / 2 for two successful matches, 1 / 3 for three successful matches, ..., and 1 / x for x successful matches.

[0027] Through formula The overall matching security coefficient of the access terminal is calculated, where i belongs to n and M. i Let μ be the matching degree of the i-th access terminal. th The matching reference value set for the system.

[0028] As a further description of the present invention, the working process of step S3 includes:

[0029] Obtain data traffic from the network slice in the current period, obtain data traffic from the server in the previous period, and construct a mathematical model for data traffic security indicators. The expression is:

[0030]

[0031] In the formula, F represents the data flow rate in the current period. th The system sets a reference value for traffic, where G is the data traffic of the previous period, and k1 and k2 are weighting coefficients, respectively.

[0032] Data traffic security indicators Compared with the data traffic security index φ0 set by the system, if If φ0 is greater than or equal to φ0, it indicates that there is malicious traffic in the current stage of data flow; otherwise, it indicates that there is no malicious traffic in the current stage of data flow.

[0033] As a further description of the present invention, the working process of step S4 includes:

[0034] Obtain the number of communications for the network slice in the current period, obtain the number of communications for the network slice in the previous period, and construct a mathematical model for the output security metric. The expression is as follows:

[0035]

[0036] In the formula, N represents the number of communications in the current cycle. th The reference value for the number of communications is set for the system, Y is the number of communications in the previous cycle, and k3 and k4 are the weighting coefficients, respectively.

[0037] Compare the output safety index τ with the system-set output safety index τ0. If τ is greater than or equal to τ0, it indicates that the current output safety status is abnormal; otherwise, it indicates that the current output safety status is normal.

[0038] As a further description of the present invention, the working process of step S5 includes:

[0039] If any of the following occurs during the current stage of a network slice: abnormal access terminal security status, presence of malicious traffic, or abnormal output security status, the network slice will be isolated. If the current stage has normal access terminal security status, no malicious traffic, and normal output security status, a mathematical model for network slice isolation indicators will be constructed, with the expression as follows:

[0040]

[0041] In the formula, k σ , and k τ The weighting coefficients are for access, data traffic, and output, respectively. The network slice isolation index ω is compared with the network slice isolation index ω0 set by the system. If ω is greater than or equal to ω0, the network slice is isolated.

[0042] A secure isolation system for 5G network slicing, the system comprising:

[0043] The data acquisition module is used to divide the 5G physical network into multiple independent network slices and collect the operating parameters of each network slice.

[0044] The data processing module is used to process the collected water quality data, remove outliers and missing values, and standardize the data.

[0045] The data analysis module is used to extract features from the processed data, extracting key features that can determine whether isolation is possible.

[0046] The isolation determination module is used to evaluate the status of network slices and determine whether a network slice is isolated based on the evaluation results.

[0047] The beneficial effects of this invention are:

[0048] 1. By using a layered quantitative assessment (state security + matching security), refined security authentication of access terminals is achieved. By using a matrix model and standardized processing, qualitative security parameters (such as firewall status) are combined with quantitative parameters (such as the number of vulnerabilities). Statistical analysis (average value, deviation) is used to assess the overall security risk, providing a foundational basis for network slicing isolation decisions.

[0049] 2. Security monitoring of core and output nodes of network slices is achieved from two dimensions: data traffic characteristics and communication behavior characteristics. A dual-period comparison model (current period vs. historical period + system threshold) is used to identify abnormal fluctuations in traffic and communication. Risk is comprehensively assessed by weighted summation, taking into account both absolute value deviation and trend changes, thereby improving the accuracy of malicious behavior detection and providing real-time traffic and communication status data support for subsequent network slice isolation decisions.

[0050] 3. This invention achieves secure isolation of network slices through a hierarchical decision-making mechanism. The emergency response layer implements immediate isolation for clearly abnormal states (such as malicious traffic and terminal security vulnerabilities) to block attack paths. The preventive decision-making layer assesses the security redundancy of slices that appear normal but have potential risk accumulation through a quantitative model to prevent risks from evolving into actual attacks. It adapts to the security requirements of different business scenarios and balances isolation accuracy with network availability. Attached Figure Description

[0051] The invention will now be further described with reference to the accompanying drawings.

[0052] Figure 1 is a partial flowchart of the 5G network slicing security isolation method provided by the present invention. Detailed Implementation

[0053] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0054] Please refer to Figure 1. This invention provides a secure isolation method for 5G network slicing, the method comprising the following steps:

[0055] Step S1: Divide the 5G physical network into multiple independent network slices, each network slice including access nodes, core nodes and output nodes;

[0056] Step S2: Set up a security authentication module at the access node of each network slice to perform security authentication on the access terminal;

[0057] Step S3: Set up a security management module at the core node of each network slice to analyze data traffic, extract the characteristics of the data traffic, and determine whether it is malicious attack traffic based on the characteristics.

[0058] Step S4: Set up a security assessment module at the output node of each network slice to perform a security assessment on the output status;

[0059] Step S5: Determine the security isolation of each network slice based on the characteristics of the access terminal, data traffic, and communication objects.

[0060] Through the above technical solution, this invention divides the 5G physical network into multiple independent slices. Each slice includes an access node, a core node, and an output node, and deploys a data acquisition module on each node. The access node is used for security authentication (terminal authentication). It calculates a terminal security status coefficient based on a weighted calculation of six parameters, including terminal operating system updates and firewall status. It dynamically calculates a terminal matching security coefficient based on the number of authentication matches, and linearly combines the terminal security status coefficient and the matching security coefficient to obtain a security index, which is then compared with a threshold. The core node is used for security management (traffic analysis). It obtains a traffic security index based on a weighted comparison of current traffic with reference values ​​and historical traffic, and compares it with a threshold. The output node is used for security assessment (output status assessment). It obtains an output security index based on a weighted comparison of current communication counts with reference values ​​and historical counts, and compares it with a threshold. Any anomaly in access, traffic, or output directly isolates the current slice. It calculates the deviation of each security index from the threshold and compares it with the threshold. If the deviation is greater than or equal to the corresponding threshold, the current slice is isolated. This achieves multi-dimensional security isolation of 5G network slices, balancing accuracy and computational efficiency.

[0061] As a further description of the present invention, the working process of step S2 includes:

[0062] Obtain the status parameters of the access terminal, and extract the overall state security factor μ of the access terminal based on the status parameters. S ;

[0063] Obtain the matching parameters of the access terminal, and extract the overall matching security factor M of the access terminal based on the matching parameters. S ;

[0064] The overall state security factor μ of the access terminal SThe overall matching security factor M with the access terminal S Substituting into the following formula, σ=α*μ S +β*M S Calculate the security index σ of the access terminal;

[0065] Compare the access terminal security indicator σ with the system-set access terminal security indicator σ0. If σ is greater than or equal to σ0, it indicates that the access terminal security status is abnormal; otherwise, it indicates that the access terminal security status is normal.

[0066] As a further description of the present invention, the process of extracting the state security coefficient of the access terminal includes:

[0067] Construct the state parameter matrix of the access terminal. The matrix expression is as follows:

[0068]

[0069] Construct the state parameter coefficient matrix of the access terminal. The matrix expression is as follows:

[0070] β=[k A k B k C k D k E k F ];

[0071] In the formula, A represents the operating system update status, B represents whether the firewall is enabled, C represents whether antivirus software is installed, D represents the number of device vulnerabilities, E represents authentication strength, and F represents the existence of the hardware trusted platform module; the elements in the β matrix are the weight coefficients corresponding to A, B, C, D, E, and F, respectively. max To allow the maximum number of vulnerabilities, E max The strongest authentication strength;

[0072] Construct a mathematical model for the security coefficient of the access terminal state, expressed as: μ=α*β T ;

[0073] Obtain the number of access terminals n, and calculate the state security coefficient of each of the n access terminals sequentially according to the mathematical model of access terminal state security coefficient, using the formula.

[0074] The overall state security factor of the access terminal is calculated, where i belongs to n, and μ i Let μ be the state security coefficient of the i-th access terminal. th The reference value for the safety factor set for the system;

[0075] If the operating system status of the access terminal has been updated, A=1; if it has expired, A=0; if the access terminal has a firewall enabled, B=1; if it has not enabled, B=0; if the access terminal has antivirus software installed, C=1; if it has not installed, C=0; if the hardware trusted platform module exists, F=1; if it does not exist, F=0.

[0076] As a further description of the present invention, the process of extracting the matching security coefficient of the access terminal includes:

[0077] The matching degree of n access terminals is obtained in sequence. The matching degree is 1 for one successful match, 1 / 2 for two successful matches, 1 / 3 for three successful matches, ..., and 1 / x for x successful matches.

[0078] Through formula The overall matching security coefficient of the access terminal is calculated, where i belongs to n and M. i Let μ be the matching degree of the i-th access terminal. th The matching reference value set for the system.

[0079] Based on the above technical solution, this embodiment proposes the working principle and implementation method of access terminal security authentication. By comprehensively evaluating the state security coefficient and matching security coefficient of the access terminal, it calculates the terminal security index and determines whether there are any security risks. The state security coefficient reflects the terminal's own security configuration (such as system updates, firewalls, antivirus software, etc.) and vulnerability status. Using a matrix model and standardized processing, qualitative security parameters (such as firewall status) are combined with quantitative parameters (such as the number of vulnerabilities) to quantify the terminal's security configuration and vulnerability risks, and comprehensively evaluate its state security. The matching security coefficient reflects the authentication efficiency of the terminal when accessing the network. By statistically analyzing the number of successful matches of the access terminal, it quantifies the efficiency and risk of its authentication. The more matches, the greater the risk of brute-force attacks or identity impersonation, and the lower the security coefficient.

[0080] As a further description of the present invention, the working process of step S3 includes:

[0081] Obtain data traffic from the network slice in the current period, obtain data traffic from the server in the previous period, and construct a mathematical model for data traffic security indicators. The expression is:

[0082]

[0083] In the formula, F represents the data flow rate in the current period. th The system sets a reference value for traffic, where G is the data traffic of the previous period, and k1 and k2 are weighting coefficients, respectively.

[0084] Data traffic security indicators Data traffic security indicators set by the system In comparison, if Greater than or equal to If it does, it means that there is malicious traffic in the current data flow; otherwise, it means that there is no malicious traffic in the current data flow.

[0085] Through the above technical solution, this embodiment provides the working principle and implementation method for detecting malicious attacks on data traffic. It obtains the data traffic in the current period and the data traffic in the previous period of the network slice, and constructs a traffic security indicator model by analyzing the data traffic change characteristics of the current period and historical periods. Determine whether there is abnormal traffic (such as malicious attack traffic) based on traffic security indicators. Greater than or equal to If it does, it means that there is malicious traffic in the current data flow; otherwise, it means that there is no malicious traffic in the current data flow.

[0086] As a further description of the present invention, the working process of step S4 includes:

[0087] Obtain the number of communications for the network slice in the current period, obtain the number of communications for the network slice in the previous period, and construct a mathematical model for the output security metric. The expression is as follows:

[0088]

[0089] In the formula, N represents the number of communications in the current cycle. th The reference value for the number of communications is set for the system, Y is the number of communications in the previous cycle, and k3 and k4 are the weighting coefficients, respectively.

[0090] Compare the output safety index τ with the system-set output safety index τ0. If τ is greater than or equal to τ0, it indicates that the current output safety status is abnormal; otherwise, it indicates that the current output safety status is normal.

[0091] Through the above technical solution, this embodiment provides the working principle and implementation method of output node security assessment, obtains the number of communications in the current period and the number of communications in the previous period of the network slice, and constructs an output security index model by analyzing the changes in the number of communications in the current period and historical periods. The stability and security of the network slice output state are evaluated based on the output security index. If τ is greater than or equal to τ0, it indicates that the output security state is abnormal in the current stage; otherwise, it indicates that the output security state is normal in the current stage.

[0092] As a further description of the present invention, the working process of step S5 includes:

[0093] If any of the following occurs during the current stage of a network slice: abnormal access terminal security status, presence of malicious traffic, or abnormal output security status, the network slice will be isolated. If the current stage has normal access terminal security status, no malicious traffic, and normal output security status, a mathematical model for network slice isolation indicators will be constructed, with the expression as follows:

[0094]

[0095] In the formula, k σ , and k τ The weighting coefficients are for access, data traffic, and output, respectively. The network slice isolation index ω is compared with the network slice isolation index ω0 set by the system. If ω is greater than or equal to ω0, the network slice is isolated.

[0096] Through the above technical solution, this embodiment provides the working principle and implementation method of network slice security isolation determination. Based on the comprehensive evaluation results of access terminal security status, data traffic characteristics, and output status, it determines whether to isolate the network slice. If any link (access terminal, data traffic, output status) is abnormal, isolation is directly triggered; if all links are normal, an isolation index model is constructed to quantify the security redundancy of each link, and further determine whether preventive isolation is needed. If ω is greater than or equal to ω0 (the isolation threshold set by the system), it indicates that the overall redundancy is insufficient or potential risks are accumulating, triggering preventive isolation; otherwise, the network slice will continue to operate normally.

[0097] A secure isolation system for 5G network slicing, the system comprising:

[0098] The data acquisition module is used to divide the 5G physical network into multiple independent network slices and collect the operating parameters of each network slice.

[0099] The data processing module is used to process the collected water quality data, remove outliers and missing values, and standardize the data.

[0100] The data analysis module is used to extract features from the processed data, extracting key features that can determine whether isolation is possible.

[0101] The isolation determination module is used to evaluate the status of network slices and determine whether a network slice is isolated based on the evaluation results.

[0102] It should be noted that all weight coefficients and thresholds in this invention are empirical values, and the weight coefficients and thresholds can be modified by taking into account the characteristics of the data type to be evaluated.

[0103] The foregoing has provided a detailed description of one embodiment of the present invention, but this description is merely a preferred embodiment and should not be construed as limiting the scope of the invention. All equivalent variations and modifications made within the scope of the claims of this invention should still fall within the patent coverage of this invention.

Claims

1. A secure isolation method for 5G network slicing, characterized in that, The method includes the following steps: Step S1, dividing the 5G physical network into multiple independent network slices, each network slice including an access node, a core node, and an output node; Step S2, setting up a security authentication module at the access node of each network slice to perform security authentication on the access terminal; Step S3, setting up a security management module at the core node of each network slice to analyze the data traffic, extract the characteristics of the data traffic, and determine whether it is malicious attack traffic based on the characteristics. Step S4: Set up a security assessment module at the output node of each network slice to assess the security status of the output. Step S5: Determine the security isolation of each network slice based on the characteristics of the access terminal, data traffic, and output status.

2. The secure isolation method for 5G network slicing according to claim 1, characterized in that, The process of step S2 includes: obtaining the status parameters of the access terminal, and extracting the overall state security factor of the access terminal based on the status parameters of the access terminal. Obtain the matching parameters of the access terminal, and extract the overall matching security factor of the access terminal based on the matching parameters. The overall state security factor of the access terminal. Overall matching security factor with access terminals Substitute into the following formula Determine the security indicators of the access terminal. Access terminal security indicators Security indicators for access terminals set by the system In comparison, if Greater than or equal to If the above indicates an abnormal security status of the access terminal, then the access terminal is in a normal security status.

3. The secure isolation method for 5G network slicing according to claim 2, characterized in that, The process of extracting the overall state security factor of the access terminal includes: constructing the state parameter matrix of the access terminal, the matrix expression of which is: Construct the state parameter coefficient matrix of the access terminal. The matrix expression is as follows: In the formula, A represents the operating system update status, B represents whether the firewall is enabled, C represents whether antivirus software is installed, D represents the number of device vulnerabilities, E represents the authentication strength, and F represents whether the hardware trusted platform module exists. The elements in the matrix represent the weight coefficients for A, B, C, D, E, and F, respectively. To allow the maximum number of vulnerabilities, The strongest authentication strength; construct a mathematical model for the security coefficient of the access terminal state, the expression of which is: Obtain the number of access terminals n, and calculate the state security coefficient of each of the n access terminals sequentially according to the mathematical model of access terminal state security coefficient, using the formula... The overall state security coefficient of the access terminal is calculated, where i belongs to n. Let be the state security coefficient of the i-th access terminal. The security factor is set as a reference value for the system; if the operating system status of the access terminal has been updated, A=1; if it has expired, A=0; if the access terminal has a firewall enabled, B=1; if it has not enabled, B=0; if the access terminal has antivirus software installed, C=1; if it has not installed, C=0; if the hardware trusted platform module exists, F=1; if it does not exist, F=0.

4. The secure isolation method for 5G network slicing according to claim 3, characterized in that, The process of extracting the overall matching security coefficient of the access terminals includes: sequentially obtaining the matching degree of n access terminals, where a successful match once results in a matching degree of 1, two successful matches result in a matching degree of 1 / 2, three successful matches result in a matching degree of 1 / 3, ..., x successful matches result in a matching degree of 1 / x; and using the formula... The overall matching security coefficient of the access terminal is calculated, where i belongs to n. Let be the matching degree of the i-th access terminal. The matching reference value set for the system.

5. The secure isolation method for 5G network slicing according to claim 1, characterized in that, The working process of step S3 includes: obtaining the data traffic of the network slice in the current period, obtaining the data traffic of the server in the previous period, and constructing a mathematical model of data traffic security indicators, the expression of which is: In the formula, For the current period's data flow, The reference value for traffic volume set for the system. For the data traffic of the previous cycle, and These are the weighting coefficients; data traffic security indicators Data traffic security indicators set by the system In comparison, if Greater than or equal to If it does, it means that there is malicious traffic in the current data flow; otherwise, it means that there is no malicious traffic in the current data flow.

6. The secure isolation method for 5G network slicing according to claim 1, characterized in that, The process of step S4 includes: obtaining the number of communications of the network slice in the current period, obtaining the number of communications of the network slice in the previous period, and constructing a mathematical model for outputting security indicators, the expression of which is: In the formula, This represents the number of communications in the current cycle. The reference value for the number of communications set by the system. This represents the number of communications in the previous cycle. and These are the weighting coefficients; the output safety index will be... Output safety indicators set by the system In comparison, if Greater than or equal to If the output is positive, it indicates that the current stage output safety status is abnormal; otherwise, it indicates that the current stage output safety status is normal.

7. The secure isolation method for 5G network slicing according to claim 1, characterized in that, The process of step S5 includes: if any of the following situations occurs in the current stage of network slicing: abnormal access terminal security status, presence of malicious traffic, or abnormal output security status, then the network slice is isolated; if the current stage has normal access terminal security status, no malicious traffic, and normal output security status, a mathematical model of network slice isolation index is constructed, the expression of which is: In the formula, 、 and The network slice isolation index is defined by the weighting coefficients corresponding to access, data traffic, and output. Network slice isolation metrics set by the system In comparison, if Greater than or equal to Then network slices are isolated.

8. A secure isolation system for 5G network slicing, used to implement the secure isolation method for 5G network slicing according to any one of claims 1-7, characterized in that, The system includes: a data acquisition module for dividing the 5G physical network into multiple independent network slices and acquiring the operating parameters of each network slice; a data processing module for processing the acquired network slice operating parameters, removing outliers and missing values, and standardizing the data; a data analysis module for extracting features from the processed data, extracting features of access terminals, data traffic, and output status that can determine whether the network slices are isolated; and an isolation determination module for evaluating the status of the network slices and determining whether the network slices are isolated based on the evaluation results.

Images