Balancing between performance and security of network slices

Abstract

Example embodiments of the present disclosure relate to balancing between performance and security of network slices. The first network device causes a change in performance of the network slice to be detected. In turn, the first network device triggers adjustment of security control of the network slice based on the change in performance and a service level agreement (SLA) of the network slice to adjust the change in performance.

Description

Technical Field

[0001] Various example embodiments of the present disclosure relate generally to the field of telecommunications, and in particular to devices, methods, apparatus, and computer-readable storage media for balancing performance and security in network slicing. Background Art

[0002] There are specific requirements from customers to dynamically adapt security requirements based on the monitored or experienced performance of the network slice. For example, they require that encryption or decryption methods should be adaptable to changes in traffic performance (such as latency, throughput). For example, if there is a degradation in latency, encryption needs to be deactivated or downgraded.

[0003] Analytics capabilities introduced since Release 16, the Network Data Analytics Function (NWDAF) and Management Data Analytics Service (MDAS) in fifth generation (5G) networks, enable monitoring and prediction of the performance and load of a network slice as a whole or for each user equipment (UE).

[0004] User Plane (UP) security policy per Packet Data Unit (PDU) session (and therefore per slice) is defined in the 3rd Generation Partnership Project (3GPP). Dynamic security policy for Quality of Service (QoS) flows per PDU session is possible.

[0005] The new study item (SI) for System Enabler for Service Function Chaining for Specific Traffic Flows (FS_SFC), approved in 3GPP System Architecture and Services Working Group 2 (SA2), is based on a service level agreement.

[0006] The 5G system (5GS) supports QoS monitoring, such as end-to-end (E2E) latency from the UE to the PDU session anchor user plane function (UPF). Summary of the Invention

[0007] In general, the example embodiments of the present disclosure provide a solution for balancing performance and security of network slicing.

[0008] In a first aspect, a first network device is provided. The first network device includes at least one processor and at least one memory storing instructions. When the instructions are executed by the at least one processor, the instructions cause the first network device to at least: detect a change in performance of a network slice; and trigger adjustment of security controls of the network slice based on the change in performance and a service level agreement (SLA) of the network slice to adjust for the change in performance.

[0009] In a second aspect, a second network device is provided. The second network device includes at least one processor and at least one memory storing instructions. When the instructions are executed by the at least one processor, the instructions cause the second network device to at least: receive a request for analysis of a network slice from a first network device; obtain performance data of the network slice based on at least the request; and generate a security policy for the network slice or an analysis report related to the performance of the network slice based on at least the request and the performance data.

[0010] In a third aspect, a third network device is provided. The third network device includes at least one processor and at least one memory storing instructions. When the instructions are executed by the at least one processor, the instructions cause the third network device to at least: obtain at least one policy and charging control (PCC) rule from the first network device, the at least one PCC rule being determined based on at least a service level agreement (SLA) of a network slice; and adjust security control of the network slice based on the at least one PCC rule.

[0011] In a fourth aspect, a third network device is provided. The third network device includes at least one processor and at least one memory storing instructions. When the instructions are executed by the at least one processor, the instructions cause the third network device to at least: obtain at least one conditional policy and charging control (C-PCC) rule from operation and maintenance, the at least one C-PCC rule being determined based on at least a service level agreement (SLA) of the network slice; send at least one condition in the at least one C-PCC rule to the first network device, the at least one condition being used to trigger adjustment of security control of the network slice; receive a message from the first network device indicating that the at least one condition is met or not met; and adjust the security control of the network slice based on the message.

[0012] In a fifth aspect, a method implemented at a first terminal device is provided, comprising: enabling, at the first network device, detection of a change in performance of a network slice; and triggering adjustment of security control of the network slice based on the change in performance and an SLA of the network slice to adjust for the change in performance.

[0013] In a sixth aspect, a method implemented at a second terminal device is provided. The method comprises: receiving, at the second network device, a request for analysis of a network slice from a first network device; obtaining performance data of the network slice based at least on the request; and generating, based at least on the request and the performance data, a security policy for the network slice or an analysis report related to the performance of the network slice.

[0014] In a seventh aspect, a method implemented at a third terminal device is provided. The method includes: obtaining, at the third network device, at least one PCC rule from the first network device, the at least one PCC rule being determined based on at least an SLA of a network slice; and adjusting security control of the network slice based on the at least one PCC rule.

[0015] In an eighth aspect, a method implemented at a third terminal device is provided. The method includes: obtaining, at the third network device, at least one C-PCC rule from operation and maintenance, the at least one C-PCC rule being determined based on at least an SLA of a network slice; sending at least one condition in the at least one C-PCC rule to a first network device, the at least one condition being used to trigger adjustment of security control of the network slice; receiving a message from the first network device indicating that the at least one condition is met or not met; and adjusting security control of the network slice based on the message.

[0016] In a ninth aspect, an apparatus is provided, comprising: means for causing a change in performance of a network slice to be detected at a first network device; and means for triggering adjustment of a security control of the network slice to adjust for the change in performance based on the change in performance and an SLA of the network slice.

[0017] In a tenth aspect, an apparatus is provided. The apparatus includes: means for receiving, at a second network device, a request for analysis of a network slice from a first network device; means for obtaining performance data of the network slice based at least on the request; and means for generating a security policy for the network slice or an analysis report related to the performance of the network slice based at least on the request and the performance data.

[0018] In an eleventh aspect, an apparatus is provided. The apparatus includes: a component for obtaining, at a third network device, at least one PCC rule from a first network device, the at least one PCC rule being determined based on at least an SLA of a network slice; and a component for adjusting security control of the network slice based on the at least one PCC rule.

[0019] In a twelfth aspect, an apparatus is provided. The apparatus includes: a component for obtaining at least one C-PCC rule from operation and maintenance at a third network device, the at least one C-PCC rule being determined based on at least an SLA of a network slice; a component for sending at least one condition in the at least one C-PCC rule to a first network device, the at least one condition being used to trigger adjustment of security control of the network slice; a component for receiving a message from the first network device indicating that the at least one condition is met or not met; and a component for adjusting security control of the network slice based on the message.

[0020] In a thirteenth aspect, a computer-readable medium is provided, wherein the computer-readable medium includes program instructions, and when the program instructions are executed by at least one processor, the program instructions cause an apparatus to at least perform the method according to any one of the fifth to eighth aspects.

[0021] It should be understood that the invention summary is not intended to identify the key or essential features of the exemplary embodiments of the present disclosure, nor is it intended to be used to limit the scope of the present disclosure. Other features of the present disclosure will become readily apparent through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Some example embodiments will now be described with reference to the accompanying drawings, in which:

[0023] Figure 1 shows an example communication network in which example embodiments of the present disclosure may be implemented;

[0024] Figure 2 A flowchart illustrating a method implemented at a first network device according to some example embodiments of the present disclosure is shown;

[0025] Figure 3 A flowchart illustrating a method implemented at a second network device according to some example embodiments of the present disclosure is shown;

[0026] Figure 4 A flowchart illustrating a method implemented at a third network device according to some example embodiments of the present disclosure is shown;

[0027] Figure 5 A flowchart illustrating a method implemented at a third network device according to some example embodiments of the present disclosure is shown;

[0028] Figure 6 shows a signaling diagram illustrating an example implementation of a process for balancing performance and security of a network slice according to some example embodiments of the present disclosure;

[0029] Figure 7 shows a signaling diagram illustrating an example implementation of a process for balancing performance and security of a network slice according to further example embodiments of the present disclosure;

[0030] Figure 8 shows a signaling diagram illustrating an example implementation of a process for balancing performance and security of a network slice according to further example embodiments of the present disclosure;

[0031] Figure 9 An example of performance measurement supporting a balance between performance and security of a network slice according to some example embodiments of the present disclosure is shown;

[0032] Figure 10shows a simplified block diagram of an apparatus suitable for implementing an example embodiment of the present disclosure; and

[0033] Figure 11 A block diagram of an example computer-readable medium is shown, according to some example embodiments of the present disclosure.

[0034] Throughout the drawings, the same or similar reference numerals denote the same or similar elements. DETAILED DESCRIPTION

[0035] The principles of the present disclosure will now be described with reference to some exemplary embodiments. It should be understood that these exemplary embodiments are described only for illustrative purposes and to help those skilled in the art understand and implement the present disclosure without implying any limitation on the scope of the present disclosure. The present disclosure as described herein can be implemented in various ways except as described below.

[0036] In the following description and claims, unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs.

[0037] References in this disclosure to "one embodiment," "an embodiment," "an example embodiment," etc., indicate that the described embodiment may include a particular feature, structure, or characteristic, but not every embodiment will necessarily include the particular feature, structure, or characteristic. Furthermore, such phrases do not necessarily refer to the same embodiment. Furthermore, when a particular feature, structure, or characteristic is described in conjunction with an example embodiment, those skilled in the art recognize that it is within their knowledge to effect such feature, structure, or characteristic in conjunction with other example embodiments, whether or not explicitly described.

[0038] It should be understood that although the terms "first", "second", etc. may be used to describe various elements in this article, these elements should not be limited by these terms. These terms are only used to distinguish one element from another. For example, without departing from the scope of the exemplary embodiments, the first element may be referred to as the second element, and similarly, the second element may be referred to as the first element. As used herein, the term "and / or" includes any and all combinations of one or more of the listed terms.

[0039] The terms used herein are for the purpose of describing specific example embodiments only and are not intended to limit the example embodiments. As used herein, the singular forms "a," "an," and "the" are also intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that when the terms "comprise," "include," "have," "have," "include," and / or "comprising" are used herein, they specify the presence of the features, elements, and / or components, etc., but do not exclude the presence or addition of one or more other features, elements, components, and / or combinations thereof.

[0040] As used in this application, the term "circuitry" may refer to one or more or all of the following:

[0041] (a) hardware circuit implementation only (such as implementation only in analog and / or digital circuitry); and

[0042] (b) a combination of hardware circuitry and software such as (where applicable):

[0043] (i) a combination of analog and / or digital hardware circuit(s) with software / firmware, and

[0044] (ii) any portion of hardware processor(s) (including digital signal processor(s)) with software, software and memory(s) that work together to enable a device (such as a mobile phone or server) to perform various functions; and

[0045] (c) Hardware circuit(s) and / or processor(s), such as microprocessor(s) or portions of microprocessor(s), that require software (e.g., firmware) for operation, but where the software is not required for operation, the software may not be present.

[0046] This definition of circuitry applies to all uses of the term in this application, including in any claims. As a further example, as used in this application, the term "circuitry" also covers an implementation of merely a hardware circuit or processor (or multiple processors) or portions of a hardware circuit or processor and their accompanying software and / or firmware. For example, and if applicable to a particular claim element, the term "circuitry" also covers a baseband integrated circuit or processor integrated circuit for a mobile device, or a similar integrated circuit in a server, cellular network device, or other computing or networking device.

[0047] As used herein, the term "communication network" refers to a network that complies with any suitable communication standard, such as a fifth generation (5G) system, long term evolution (LTE), advanced LTE (LTE-A), wideband code division multiple access (WCDMA), high speed packet access (HSPA), narrowband Internet of Things (NB-IoT), etc. In addition, the communication between the terminal device and the network equipment in the communication network can be performed according to any suitable intergenerational communication protocol, including but not limited to first generation (1G), second generation (2G), 2.5G, 2.75G, third generation (3G), fourth generation (4G), 4.5G, fifth generation (5G) new radio (NR) communication protocol, and / or any other currently known or future protocols to be developed. The example embodiments of the present disclosure can be applied to various communication systems. In view of the rapid development of communications, there will certainly be future types of communication technologies and systems that can be used to implement the present disclosure. This should not be regarded as limiting the scope of the present disclosure to the above-mentioned systems.

[0048] As used herein, the term "network device" refers to a node in a communication network via which a terminal device accesses the network and receives services therefrom. A network device may refer to a base station (BS) or an access point (AP), for example, a NodeB (NodeB or NB), an evolved NodeB (eNodeB or eNB), a NR next-generation NodeB (gNB), a remote radio unit (RRU), a radio head (RH), a remote radio head (RRH), a relay, a low-power node (such as a femto, pico), etc., depending on the terminology and technology applied. The RAN split architecture includes a gNB-CU (centralized unit, carrying radio resource control (RRC), service data adaptation protocol (SDAP), and packet data convergence protocol (PDCP)), which controls multiple gNB-DUs (distributed units, carrying radio link control (RLC), medium access control (MAC), and physical layer (PHY)).

[0049] A network device can also be referred to as a network function (NF). An NF can be part of a node or not the entire node. Several NFs can be embedded in a physical node.

[0050] NF can be a defined processing function in the network, with defined behavior and defined interfaces. NF can be implemented as a network element on dedicated hardware, or as a software instance running on dedicated hardware, or as a virtualized function instantiated on an appropriate platform (e.g., on a cloud infrastructure).

[0051] The term "terminal device" refers to any terminal device that can perform wireless communication. As an example and not limitation, a terminal device may also be referred to as a communication device, user equipment (UE), subscriber station (SS), portable subscriber station, mobile station (MS) or access terminal (AT). Terminal devices may include, but are not limited to, mobile phones, cellular phones, smart phones, voice over IP (VoIP) phones, wireless local loop phones, tablet computers, wearable terminal devices, personal digital assistants (PDAs), portable computers, desktop computers, image capture terminal devices (such as digital cameras), game terminal devices, music storage and playback devices, vehicle-mounted wireless terminal devices, wireless endpoints, mobile stations, laptop embedded devices (LEEs), laptop mounted devices (LMEs), USB dongles, smart devices, wireless customer premises equipment (CPEs), Internet of Things (IoT) devices, watches or other wearable devices, head-mounted displays (HMDs), vehicles, drones, medical devices and applications (such as remote surgery), industrial devices and applications (such as robots and / or other wireless devices operating in industrial and / or automated process chain environments), consumer electronic devices, devices operating on commercial and / or industrial wireless networks, etc. In the following description, the terms “terminal device,” “communication device,” “terminal,” “user equipment,” and “UE” may be used interchangeably.

[0052] Although in various example embodiments, the functions described herein may be performed in fixed and / or wireless network nodes, in other example embodiments, the functions may be implemented in a user equipment device (such as a mobile phone or tablet or laptop or desktop computer or mobile IoT device or fixed IoT device). The user equipment device may, for example, be equipped with corresponding capabilities as described in relation to fixed and / or (multiple) wireless network nodes, as appropriate. The user equipment device may be a user device and / or a control device, such as a chipset or processor, configured to control the user device when installed therein. Examples of such functions include bootstrap server functions and / or home subscriber servers, which may be implemented in the user equipment device by providing the user equipment device with software configured to cause the user equipment device to perform from the perspective of these functions / nodes.

[0053] Figure 1 An example communication environment 100 is shown in which example embodiments of the present disclosure may be implemented. Environment 100 may include a first network device 102, a second network device 104, and a third network device 106 in communication with one another.

[0054] In some example embodiments, the first network device 102 may be implemented as a Security Anchor Function (SAnF). Alternatively, the first network device 102 may be implemented as an existing NF, such as a Policy Control Function (PCF).

[0055] In some example embodiments, the second network device 104 may be implemented as an analysis network function (NF), and the third network device 106 may be implemented as a PCF.

[0056] In some example embodiments, environment 100 may optionally further include operation and maintenance (OAM) 108, data management (UDM) 110, access and mobility management function (AMF) 112, session management function (SMF) 114, application function (AF) 116, terminal device 118, radio access network (RAN) 120, user plane function (UPF) 122, and data network (DN) 124.

[0057] It should be understood that the number of devices is for ease of understanding only and does not imply any limitation. Communication environment 100 may include any appropriate number or type of devices suitable for implementing embodiments of the present disclosure.

[0058] Communications in the communication environment 100 may be implemented according to any suitable communication protocol(s), including, but not limited to, first generation (1G), second generation (2G), third generation (3G), fourth generation (4G), fifth generation (5G), or future sixth generation (6G) wireless local area network communication protocols (such as Institute of Electrical and Electronics Engineers (IEEE) 802.11), and / or any other protocol currently known or to be developed in the future. In addition, communications may utilize any suitable wireless communication technology, including, but not limited to, code division multiple access (CDMA), frequency division multiple access (FDMA), time division multiple access (TDMA), frequency division duplex (FDD), time division duplex (TDD), multiple input multiple output (MIMO), orthogonal frequency division multiple access (OFDM), discrete Fourier transform spread spectrum OFDM (DFT-s-OFDM), and / or any other technology currently known or to be developed in the future.

[0059] During the deployment or commissioning phase of a network slice, the balance between the performance and security of the network slice needs to be considered to determine which security features need to be deployed and which security policies or rules should be set based on their impact on performance. Examples of network slice performance may include, but are not limited to, latency, throughput, content, reliability, and availability.

[0060] Before or during the creation of a network slice, a pre-deployment or commissioning analysis of potential performance requirements based on historical data may be required. For example, a partial feasibility check may be required, but this may trigger the creation of new resources.

[0061] During the operation of a network slice, in the event of performance degradation, the balance between the performance and security of the network slice needs to be considered. For example, if the latency increases in an ultra-reliable low-latency communication (uRLLC) network slice (such as autonomous driving, remote robotics, extended reality (XR) or virtual reality (VR)), at least one of the following can be taken to mitigate the problem:

[0062] Access control,

[0063] Expand network resources but it may take too much time,

[0064] Disable analytics, or

[0065] Stop collecting certain performance data, Minimization of Drive Tests (MDT), and Quality of Experience (QoE).

[0066] As per customer needs, enhanced processes and / or architectural improvements need to be provided, which should allow 5GS to dynamically respond to performance degradation by relaxing security controls.

[0067] Security always comes with a cost. Implementing security (e.g., encryption or integrity protection using different algorithms) has an impact on system performance. New encryption or integrity protection methods are constantly being added to various Request for Comments (RFCs) within the Internet Engineering Task Force (IETF).

[0068] This may be possible in an operator internal environment, but may also be the case where a mobile network operator (MNO) interacts with external stakeholders.

[0069] In an operator's internal environment, there may be the following use cases related to the balance between performance and security of network slicing:

[0070] Performance impact on the Uu interface for UP traffic destined for a UE or slice due to ciphering or integrity protection;

[0071] Performance impact on the N6 / N3 interface for UP traffic destined for a UE or slice due to encryption or integrity protection of traffic, forwarding (FW) to filter traffic, and other security functions such as intrusion detection system (IDS) / intrusion prevention system (IPS), distributed denial of service (DDoS) protection;

[0072] Performance impact on the Service-Based Architecture (SBA) interface for control plane (CP) traffic towards the UE or slice due to authentication / authorization mechanisms and / or TLS with strict security policies configured in the profile, or due to overhead introduced by indirect communication; or

[0073] Performance impact on the N1, N2, or N3 interfaces for CP traffic destined for a UE or slice due to transport security.

[0074] In the case of MNOs interacting with external stakeholders, there can be the following use cases related to the balance between performance and security of network slicing:

[0075] N9 interface performance impact on UP traffic for UEs or slices using home-routed PDU sessions (inter-PLMN via the N9 interface) in roaming scenarios;

[0076] Performance impact on the N9 / N6 interface for UP traffic to a UE or slice in the case of 5GS interaction with an external service provider, such as an Edge Compute (EC) provider; as per TS 23.501, an EC is represented by its Application Function (AF) at the control plane and the N6 interface at the data plane; or

[0077] Performance impact on the N32 interface for CP traffic targeting UEs or slices in roaming scenarios.

[0078] The present disclosure provides a solution for balancing the performance and security of a network slice. According to the solution, a first network device detects a change in the performance of the network slice. Furthermore, the first network device triggers adjustment of security controls of the network slice based on the performance change and a service level agreement (SLA) of the network slice to adjust for the performance change.

[0079] In the following, reference will be made to Figures 2 to 9 The principles of the present disclosure are described.

[0080] Figure 2 FIG2 is a flow chart illustrating an example method 200 implemented at a network device according to some example embodiments of the present disclosure. For the purpose of discussion, the method 200 will be described with respect to FIG2 . Figure 1 It is described from the perspective of the first network device 102 .

[0081] At block 210 , the first network device 102 causes a change in performance of the network slice to be detected.

[0082] At block 220 , the first network device 102 triggers adjustment of security controls of the network slice based on the change in performance and the SLA of the network slice to adjust for the change in performance.

[0083] Figure 3 A flow chart of an example method 300 implemented at a network device according to some example embodiments of the present disclosure is shown. For the purposes of discussion, the method 300 will be described with respect to Figure 1 It is described from the perspective of the second network device 104 .

[0084] At block 310 , the second network device 104 receives a request for analysis of the network slice from the first network device 102 .

[0085] At block 320, the second network device 104 obtains performance data of the network slice based at least on the request.

[0086] At block 330, the second network device 104 generates a security policy for the network slice or an analysis report related to the performance of the network slice based at least on the request and the performance data.

[0087] Figure 4 FIG. 4 is a flow chart illustrating an example method 400 implemented at a network device according to some example embodiments of the present disclosure. For the purposes of discussion, the method 400 will be described with respect to FIG. Figure 1 It is described from the perspective of the third network device 106 .

[0088] At block 410, the third network device 106 obtains at least one policy and charging control (PCC) rule from the first network device 102. The at least one PCC rule is determined based on at least a service level agreement (SLA) of the network slice.

[0089] At block 420 , the third network device 106 adjusts security controls of the network slice based on at least one PCC rule.

[0090] Figure 5 A flow chart of an example method 500 implemented at a network device according to some example embodiments of the present disclosure is shown. For the purposes of discussion, the method 500 will be described with respect to Figure 1 It is described from the perspective of the third network device 106 .

[0091] At block 510, the third network device 106 obtains at least one conditional policy and charging control (C-PCC) rule from the OAM 108. The at least one C-PCC rule is determined based on at least a service level agreement (SLA) of the network slice.

[0092] At block 520, the third network device 106 sends at least one condition in at least one C-PCC rule to the first network device 102. The at least one condition is used to trigger adjusting security control of the network slice.

[0093] At block 530 , the third network device 106 receives a message from the first network device 102 indicating that at least one condition is satisfied or not satisfied.

[0094] At block 540, the third network device 106 adjusts security controls of the network slice based on the message.

[0095] Policy-based solutions

[0096] In some example embodiments, the first network device 102 can adjust security controls based on performance changes and at least one conditional policy and charging control (C-PCC) rule trigger. Such embodiments are also referred to as policy-based solutions.

[0097] In some example embodiments, at least one C-PCC rule may be determined based on the SLA of the network slice.

[0098] In some example embodiments, at least one C-PCC rule may be determined based on the SLA of the network slice and at least one of: operator policy, measurements from verifiable experiments measuring the impact of heterogeneous SFs or security algorithms on the performance of the network slice, historical data, experience, or offline risk analysis. In addition to performance, other conditions such as time, service area, application-level security, and / or packet type may also be considered to determine the at least one C-PCC rule.

[0099] In this example embodiment, the at least one C-PCC rule may include at least one of the following:

[0100] at least one condition for triggering adjustment of a security control,

[0101] a target indicating at least one of: at least one NF to which at least one security policy for regulating variations in performance will be enforced, or at least one network interface between NFs to which C-PCC rules will be enforced,

[0102] Indicates the scope of at least one object to be affected by the enforcement of at least one C-PCC rule, or

[0103] • At least one security policy adjustment action to adjust for changes in performance.

[0104] In some example embodiments, the at least one object may include at least one of: a network slice, a packet data unit (PDU) session, or at least one terminal device connected to the network slice.

[0105] Table 1 shows examples of C-PCC rules.

[0106] Table 1

[0107]

[0108]

[0109]

[0110] Figure 6A signaling diagram illustrating an example implementation of a process 600 for balancing performance and security of a network slice according to some example embodiments of the present disclosure is shown. The process 600 may be viewed as an example implementation of a policy-based solution. For the purposes of this discussion, the process 600 will refer to Figure 1 Process 600 may involve Figure 1 1 , the first network device 102, the third network device 106, the OAM 108 and the SMF 114, and the NF 602 are shown in FIG. The NF 602 may include one or more 5GS components, such as Figure 1 AMF 112, SMF 114, UPF 122, AF 116 and / or RAN 120 in.

[0111] like Figure 6 As shown, the first network device 102 obtains 611 at least one C-PCC rule from the OAM 108. In addition, the first network device 102 records an identifier (ID) of each C-PCC rule.

[0112] Alternatively, the third network device 106 may obtain the at least one C-PCC rule from the OAM 108. The first network device 102 may obtain the at least one condition in the at least one C-PCC rule from the third network device 106.

[0113] The first network device 102 obtains 612 performance data of the network slice from the NF 602. This will be referred to later. Figure 9 and Table 4 are described.

[0114] For example, the first network device 102 may subscribe to a performance monitoring service at the NF 602. The first network device 102 may record each subscription ID. The first network device 102 may bind the subscription ID to a related C-PCC rule ID within the conditional security service.

[0115] The first network device 102 determines 613 whether at least one condition is satisfied or not satisfied.

[0116] If first network device 102 determines that the at least one condition is met or not met, first network device 102 sends 614 to third network device 106 at least one PCC rule for adjusting for the change in performance.

[0117] Alternatively, in an embodiment where first network device 102 obtains at least one condition in at least one C-PCC rule from third network device 106, if the at least one condition is satisfied or not satisfied, first network device 102 sends at least one message indicating that the at least one condition is satisfied or not satisfied to third network device 106. In this example embodiment, third network device 106 locally maintains at least one C-PCC rule and retrieves at least one PCC rule based on the condition.

[0118] Furthermore, the third network device 106 sends at least one PCC rule to the network function of the network slice for enforcing security controls for the network slice. For example, the third network device 106 may send 615 the at least one PCC rule to the SMF 114. Alternatively, the third network device 106 may replace the old PCC rule set with the new PCC rule set on the SMF 114.

[0119] In some example embodiments, first network device 102 may continuously monitor performance and adjust policies over time.

[0120] Analytics-based solutions

[0121] In some example embodiments, the first network device 102 may trigger adjustments to security controls based on changes in performance and analysis of the performance of the network slice performed by the second network device 104. Such embodiments are also referred to as analysis-based solutions. This will refer to Figure 7 described.

[0122] Figure 7 A signaling diagram illustrating an example implementation of a process 700 for balancing performance and security of a network slice according to other example embodiments of the present disclosure is shown. The process 700 may be viewed as an example implementation of an analysis-based solution. For the purposes of this discussion, the process 700 will refer to Figure 1 Process 700 may involve Figure 1 The first network device 102, the second network device 104, the third network device 106, the terminal device 118 (also referred to as UE 118), the RAN 120, the UPF 122 and the SMF 114 shown in FIG. Figure 1 The terminal device 702 (also referred to as UE 702) is not shown in the figure.

[0123] like Figure 7 As shown, at 711a and 711b, UE 118 and UE 702 (or any other UE) are connected to the network slice with ID 1 (also referred to as slice 1) and consume the services of slice 1.

[0124] First network device 102 sends a request for a recommendation for security controls based on an analysis of the performance of a network slice (i.e., slice 1) to second network device 104 (712). In other words, first network device 102 requests second network device 104 to perform an analysis of the performance of the network slice and provide a security recommendation.

[0125] In some example embodiments, the request includes at least one of the following:

[0126] The type of analysis (also known as the analysis ID),

[0127] The identifier of the network slice (e.g., Slice 1), or

[0128] At least one interface between network functions from which performance data for the network slice is obtained.

[0129] Upon receiving the request, the second network device 104 obtains 713 performance data of the network slice based on at least the request. For example, the second network device 104 may obtain 713 performance data of the network slice from one or more 5GS components such as Figure 1 AMF 112, SMF 114, UPF 122, AF 116 and / or RAN 120 in the network obtain performance data. This will be referred to later. Figure 9 and Table 4 are described.

[0130] Assume that the second network device 104 is aware of different performance KPIs for different security methods. For example, for the CU-DU interface, encryption using methods X, Y, and Z is supported, and each method has an X1, Y1, and Z1 load on the system. Therefore, changing the encryption method from X to Y or disabling encryption will have a performance gain on the system or interface.

[0131] Furthermore, the second network device 104 performs an analysis of the performance of the network slice and generates a security policy for the network slice based at least on the request and the performance data. The security policy may be for at least one interface and / or at least one UE.

[0132] In some example embodiments, second network device 104 may generate security policies continuously or periodically.

[0133] Second network device 104 then sends 714 a response to the request for a recommendation for security controls.

[0134] In some example embodiments, the response may include at least a security policy for the network slice.

[0135] In some example embodiments, the security policy may indicate an adjustment action or recommendation for adjusting a change in the performance of the network slice. Table 2 shows examples of adjustment actions or recommendations.

[0136] Table 2

[0137]

[0138] In some exemplary embodiments, the response may further include at least one of the following:

[0139] Type of analysis,

[0140] The identifier of the network slice (e.g., slice 1),

[0141] At least one interface between network functions from which performance data for the network slice is obtained (e.g., the interface between the DU and the UPF);

[0142] at least one object that will be affected by the enforcement of the security policy (e.g., UE 118),

[0143] the length of time during which the security policy will be enforced (e.g., T1-T2),

[0144] The reason for the performance change (e.g., overload at slice 1), or

[0145] • The confidence level of the security policy (high or low).

[0146] It should be noted that the second network device 104 can obtain a list of UEs currently consuming resources from the 5GC. For example, the UDM 110 can provide a list of subscribed UEs for the network slice. The AMF 112 or the Network Slice Admission Control Function (NSACF) can provide a list of UEs currently consuming resources of the network slice.

[0147] Based on the response from second network device 104, first network device 102 decides an action. Based on operator policy or the confidence level in the response, first network device 102 may decide not to change the security policy. If first network device 102 decides to change the security policy for UE 118 as recommended by second network device 104, first network device 102 may send 716a the security policy to third network device 106. For example, first network device 102 may notify third network device 106 to change the security policy for UE 118 by disabling encryption during the period T1-T2.

[0148] In turn, the third network device 106 may notify 716b the UPF 122 or SMF 114 to change the security policy for the UE 118 by stopping encryption during T1-T2.

[0149] The UPF 122 or SMF 114 may notify 716c the RAN 120 to change the security policy for the UE 118 by stopping encryption during T1-T2.

[0150] Then, RAN 120 downgrades 717a the ciphering of UE 118 from T1 to T2. UPF 122 or SMF 114 downgrades 717b the ciphering of UE 118 from T1 to T2.

[0151] At 718, the connection parameters of UE 118 are changed, and the interface between the RAN and UPF is not encrypted.

[0152] In this way, the performance of UE 118 begins to upgrade. Process 700 may be repeated to ensure that the security and performance balance is maintained in the system.

[0153] Hybrid solutions

[0154] In some example embodiments, first network device 102 may trigger adjustment of security controls based on an analysis of a change in performance of the network slice, at least one C-PCC rule, and performance performed by second network device 104. Such an embodiment is also referred to as a hybrid solution. This will refer to Figure 8 described.

[0155] Figure 8 A signaling diagram illustrating an example implementation of a process 800 for balancing performance and security of a network slice according to other example embodiments of the present disclosure is shown. The process 800 may be viewed as an example implementation of a hybrid solution. For the purposes of this discussion, the process 800 will refer to Figure 1 Process 800 may involve Figure 1 The first network device 102, the second network device 104, the third network device 106, the OAM 108, the UDM 110 or the unified data repository (UDR) shown in FIG. Figure 1 ), SMF 114, AF 116, terminal equipment 118, RAN 120 and UPF 122.

[0156] like Figure 8 As shown in , the third network device 106 obtains 811 at least one C-PCC rule from the OAM 108. Table 3 shows another example of C-PCC rules.

[0157] Table 3

[0158]

[0159]

[0160] The first network device 102 obtains 812 at least one condition in at least one C-PCC rule from the third network device 106. The at least one condition is used to trigger adjusting security control of the network slice.

[0161] Alternatively, in some example embodiments, first network device 102 may obtain at least one C-PCC rule from OAM 108 .

[0162] First network device 102 sends 813 a request for analysis of the performance of the network slice to second network device 104. For example, first network device 102 can subscribe to analysis reports related to the performance of the network slice from second network device 104. For example, if second network device 104 acts as a management data analysis service producer (MDAS-P), first network device 102 can subscribe to service level service (SLS) analysis reports from MDAS-P. For another example, if second network device 104 acts as an NWDAF, first network device 102 can subscribe to DN performance analysis from NWDAF.

[0163] The request for performance analysis may include at least one of the following: an analysis ID, an S-NSSAI, or a service area of ​​the network slice for which performance data is to be obtained. For example, the service area of ​​the network slice for which performance data is to be obtained may include a tracking area. It should be noted that the analysis ID in the request is not related to the reference Figure 7 The analysis ID described is different.

[0164] Furthermore, the second network device 104 obtains (i.e., collects) performance data of the network slice based on the request.

[0165] For example, second network device 104 may obtain 814.1 performance data from AF 116. For another example, second network device 104 may obtain 814.2 performance data from UPF 122. For another example, second network device 104 may obtain 814.3 performance data from RAN 120 (such as a gNB). For another example, second network device 104 may obtain 814.4 performance data from a management function (MF).

[0166] Table 4 shows examples of performance data for network slicing.

[0167] Table 4

[0168]

[0169]

[0170]

[0171]

[0172] It should be noted that in Table 4, the performance data of the network slice is also referred to as performance measurement or KPI of the network slice.

[0173] As shown in Table 4, the performance data includes at least one of the following:

[0174] The E2E latency between the AF and the terminal device connected to the network slice (denoted by M1),

[0175] The round-trip time between the UPF and the terminal device (represented by M2),

[0176] The first difference between the E2E delay and the round-trip time (denoted by M8),

[0177] a second difference between the round trip time and the average uplink (UL) or downlink (DL) packet delay between the packet data unit session anchor (PSA) UPF and the terminal device (denoted by M9), or

[0178] UL or DL ​​latency in the user plane (UP) of the Centralized Unit (CU) in the network slice (represented by M6).

[0179] In some example embodiments, M1 may indicate an end-to-end performance issue for the network slice, M6 or M9 reflects the latency at the PDCP layer and may indicate that confidentiality / integrity protection of UP traffic in the Uu interface may be the main contributor to the latency, M8 may reflect the latency caused by the service function chain (SFC) on N6, and M7 may reflect the latency caused by the General Packet Radio Service (GPRS) Tunneling Protocol for the User Plane (GTP-U) protection on N3.

[0180] It should be noted that all measurements or KPIs in Table 4 can be collected per S-NSSAI, but performance issues may only occur in part of the network slice. Therefore, the measurements or KPIs may need to be extended to support collection per S-NSSAI, per service area (e.g., tracking area).

[0181] It should also be noted that the second network device 104 can obtain performance data from another network device acting as an analysis function. For example, if the second network device 104 acts as an MDAS-P, the second network device 104 can obtain performance data from the NWDAF, such as the E2E latency between the AF 116 and the UE 118 for the network slice within the region.

[0182] Figure 9Examples of performance measurements for supporting a balance between performance and security of a network slice according to some example embodiments of the present disclosure are shown.

[0183] When acquiring the performance data, the second network device 104 performs an analysis of the performance of the network slice. For example, the second network device 104 may perform a service level specification (SLS) analysis as defined in 8.4.2 of 3GPP TS 28.104, or perform a new type of analysis to generate a latency / throughput analysis.

[0184] Furthermore, the second network device 104 generates 815 an analysis report related to the performance of the network slice based at least on the request and the performance data. For example, if the request includes a TAI, the second network device 104 can generate an analysis report for each TAI.

[0185] Second network device 104 then sends 816 a response to the request to first network device 102. The response includes an analysis report.

[0186] In some example embodiments, the analysis report includes at least one of the following:

[0187] The ID of the performance issue of the network slice (also known as the issue ID),

[0188] The type of performance issue (e.g., CU / UE (PDCP) latency, N6 latency, N3 latency, etc.), or

[0189] • At least one object affected by the performance issue (e.g. cell, TA, etc. to be understood by the signaling plane).

[0190] Correspondingly, the first network device 102 receives a response including the analysis report. For example, the analysis report can be pushed to the first network device 102 by the second network device 104, or pulled by the first network device 102 after receiving a notification from the second network device 104.

[0191] Furthermore, the first network device 102 triggers 817 to adjust security controls based on the C-PCC rules and the analysis report.

[0192] To trigger the adjustment of the security control, the first network device 102 can determine whether the ID of the performance issue matches the ID of a first C-PCC rule in the at least one C-PCC rule.

[0193] If the ID of the performance issue matches the ID of a first C-PCC rule in the at least one C-PCC rule, the first network device 102 may obtain the type of the performance issue and at least one object from the analysis report. Furthermore, the first network device 102 may determine the first C-PCC rule based on the ID of the first C-PCC rule.

[0194] The first network device 102 may also determine whether the type of the performance issue matches a target in the first C-PCC rule and whether at least one object matches an object in a scope in the first C-PCC rule.

[0195] If the type of the performance issue matches the target in the first C-PCC rule, and at least one object matches an object in the scope in the first C-PCC rule, the first network device 102 may obtain at least one security policy adjustment action in the first C-PCC rule. Furthermore, the first network device 102 may trigger an adjustment security control based on the at least one security policy adjustment action.

[0196] Then, the first network device 102 obtains at least one object in the scope of the first C-PCC rule. For example, the first network device 102 can obtain 818 the affected UE and PDU session based on the S-NSSAI and / or TA in the scope of the first C-PCC rule.

[0197] In some example embodiments, if the security control for the affected PDU session on the Uu or N6 interface needs to be updated, the first network device 102 sends 819 PDU Session Update Request to the corresponding PCF (e.g., PCF 106) to update the security policy. PCF 106 then updates the security policy in the relevant SMF 114 by sending 819.1 Policy Update Notification. Alternatively, the first network device 102 can send the PDU Session Update Request directly to the SMF 114.

[0198] If the user plane (UP) security policy for the Uu interface needs to be changed, SMF 114 notifies 819.2 a PDU session modification to RAN 120. RAN 120 then sends 819.2 a PDU session modification message to UE 118 to update the security policy for the PDU session. If the traffic steering policy / traffic steering control information needs to be changed, SMF 114 notifies 819.3 UPF 122 to update the traffic steering policy (TSP).

[0199] It should be noted that SMF 114 can trigger the re-establishment of a new PDU session and apply the new security policy on the new PDU session instead of updating the PDU session. In addition, the new security policy will be enforced on any new PDU session within the scope of at least one C-PCC rule.

[0200] If security controls on N3 for the network slice need to be updated, the first network device 102 can notify the OAM 108 820 of the new security policy. The OAM 108 will update the security controls. For example, the OAM 108 can reconfigure 820.1 security on the N3 endpoint (EP) for the network slice. For another example, the OAM 108 can reconfigure 820.2 security on the Next Generation User Plane (NG-U) EP for the network slice.

[0201] Afterwards, UP traffic on the Uu interface can be protected based on the new integrity / confidentiality policy and / or algorithm, N3 traffic can be protected based on the new security profile, and UP traffic can be directed through the new security function chain. Overall performance or latency can then be improved.

[0202] It should be noted that the reference Figures 6 to 9 Details of the described example embodiments may be applied to at least one of the methods 200 , 300 , 400 , and 500 .

[0203] In some example embodiments, an apparatus capable of performing any of the methods 200 (e.g., first network device 102) may include a component for performing the corresponding operations of method 200. The component may be implemented in any suitable form. For example, the component may be implemented as a circuit system or a software module. The apparatus may be implemented as or included in first network device 102. In some example embodiments, the component may include a processor and a memory.

[0204] In some example embodiments, the apparatus includes: a component for causing a change in performance of a network slice to be detected at a first network device; and a component for triggering adjustment of security controls of the network slice to adjust for the change in performance based on the change in performance and an SLA for the network slice.

[0205] In some example embodiments, the component for triggering includes a component for triggering adjustment of security controls based on a change in performance and at least one of: at least one C-PCC rule determined based at least on the SLA, or an analysis of the performance of the network slice performed by the second network device.

[0206] In some example embodiments, at least one C-PCC rule includes at least one of: at least one condition for triggering adjustment of the security control, indicating a target of at least one of: at least one network function for which at least one security policy for adjusting the change in performance will be enforced, or at least one network interface between network functions for which the C-PCC rule will be enforced, indicating a scope of at least one object that will be affected by enforcement of the at least one C-PCC rule, or at least one security policy adjustment action for adjusting the change in performance.

[0207] In some example embodiments, the at least one object includes at least one of: a network slice, a PDU session, or at least one terminal device connected to the network slice.

[0208] In some example embodiments, the means for causing the change in performance includes means for causing the change in performance of the network slice to be detected by obtaining performance data of the network slice. In such example embodiments, the apparatus further includes means for obtaining at least one C-PCC rule from operations and maintenance. The means for triggering includes means for triggering adjusting security controls by, based on determining that at least one condition is met or not met, sending at least one PCC rule for adjusting the change in performance to a third network device. In such example embodiments, the third network device sends the at least one PCC rule to a network function of the network slice for enforcement of security controls for the network slice.

[0209] In some example embodiments, the apparatus further comprises: means for obtaining at least one condition in the at least one C-PCC rule from a third network device. The means for triggering comprises means for triggering adjusting the security control by: based on determining that the at least one condition is satisfied or not satisfied, sending at least one message indicating that the at least one condition is satisfied or not satisfied.

[0210] In some example embodiments, the component for causing a change in performance includes: a component for causing a change in the performance of the network slice to be detected by sending a request for a recommendation for security control to a second network device based on an analysis of the performance of the network slice.

[0211] In some example embodiments, the request includes at least one of: a type of analysis, an identifier of a network slice, or at least one interface between network functions from which performance data for the network slice is obtained.

[0212] In some example embodiments, the component for triggering adjustment of security control includes: a component for receiving a response to the request from the second network device, the response including at least a security policy for the network slice; and a component for sending the security policy for the security control of the network slice to the third network device.

[0213] In some example embodiments, the response further includes at least one of: a type of analysis, an identifier of the network slice, at least one interface between network functions, performance data for the network slice from which the network functions are obtained, at least one object that will be affected by the enforcement of the security policy, a duration during which the security policy will be enforced, a reason for the change in performance, or a confidence level in the security policy.

[0214] In some example embodiments, the apparatus further comprises: means for obtaining at least one condition in at least one C-PCC rule from a third network device, or obtaining at least one C-PCC rule from operation and maintenance, wherein the at least one condition is used to trigger adjustment of security control. The means for triggering adjustment of security control comprises: means for sending a request for analysis of performance of the network slice to the second network device; means for receiving an analysis report related to the performance of the network slice from the second network device; and means for triggering adjustment of security control based on the at least one C-PCC rule and the analysis report.

[0215] In some example embodiments, the analysis report includes at least one of: an identifier of a performance problem for the network slice, a type of the performance problem, or at least one object affected by the performance problem.

[0216] In some example embodiments, a component for triggering adjustment of security control based on at least one C-PCC rule and an analysis report includes: a component for obtaining a type of performance problem and at least one object from an analysis report based on determining that an identifier of the performance problem matches an identifier of a first C-PCC rule in at least one C-PCC rule; a component for determining a first C-PCC rule based on the identifier of the first C-PCC rule; a component for obtaining at least one security policy adjustment action in the first C-PCC rule based on determining that the type of the performance problem matches a target in the first C-PCC rule and at least one object matches an object within the scope of the first C-PCC rule; and a component for triggering adjustment of security control based on the at least one security policy adjustment action.

[0217] In some example embodiments, means for triggering adjustment of security control based on at least one security policy adjustment action includes means for sending a notification to a third network device that a security policy for an object in a scope in the first C-PCC rule is to be updated based on the at least one security policy adjustment action.

[0218] In some example embodiments, an apparatus capable of performing any of the methods 300 (e.g., the second network device 104) may include a component for performing the corresponding operations of the method 300. The component may be implemented in any suitable form. For example, the component may be implemented as a circuit system or a software module. The apparatus may be implemented as or included in the second network device 104. In some example embodiments, the component may include a processor and a memory.

[0219] In some example embodiments, the apparatus includes: a component for receiving, at a second network device, a request for analysis of a network slice from a first network device; a component for obtaining performance data of the network slice based at least on the request; and a component for generating a security policy for the network slice or an analysis report related to the performance of the network slice based at least on the request and the performance data.

[0220] In some example embodiments, the request includes a request for recommendations for security controls for the network slice based on an analysis of the performance of the network slice.

[0221] In some example embodiments, the request includes at least one of: a type of analysis, an identifier of a network slice, or at least one interface between network functions from which performance data for the network slice is obtained.

[0222] In some example embodiments, the apparatus further comprises a component for sending a response to the request to the first network device, the response comprising at least a security policy for the network slice.

[0223] In some example embodiments, the response further includes at least one of: a type of analysis, an identifier of the network slice, at least one interface between network functions, performance data for the network slice from which the network functions are obtained, at least one object that will be affected by the enforcement of the security policy, a duration during which the security policy will be enforced, a reason for a change in the performance of the network slice, or a confidence level in the security policy.

[0224] In some example embodiments, the apparatus further comprises means for sending a response to the request to the first network device, wherein the response comprises an analysis report, and the analysis report comprises at least one of: an identifier of the performance issue of the network slice, a type of the performance issue, or at least one object affected by the performance issue.

[0225] In some example embodiments, the request indicates a service area of ​​a network slice for which performance data is to be obtained.

[0226] In some example embodiments, the performance data includes at least one of the following: end-to-end delay between the AF and a terminal device connected to the network slice, a round-trip time between the UPF and the terminal device, a first difference between the end-to-end delay and the round-trip time, a second difference between the round-trip time and the average uplink or downlink packet delay, a packet delay between the PSA UPF and the terminal device, or an uplink or downlink delay in a user plane of a centralized unit in the network slice.

[0227] In some example embodiments, an apparatus capable of performing any of the methods 400 (e.g., the third network device 106) may include a component for performing the corresponding operations of the method 400. The component may be implemented in any suitable form. For example, the component may be implemented as a circuit system or a software module. The apparatus may be implemented as or included in the third network device 106. In some example embodiments, the component may include a processor and a memory.

[0228] In some example embodiments, the apparatus includes: a component for obtaining, at a third network device, at least one policy and charging control (PCC) rule from the first network device, the at least one PCC rule being determined based at least on an SLA for the network slice; and a component for adjusting security control of the network slice based on the at least one PCC rule.

[0229] In some example embodiments, at least one PCC rule includes at least one of: a target indicating at least one network function on which at least one security policy adjustment action for adjusting a change in performance of a network slice will be enforced, and / or at least one network interface between network functions on which the PCC rule will be enforced; indicating a scope of at least one object that will be affected by enforcement of the at least one PCC rule, or at least one security policy adjustment action for adjusting a change in performance.

[0230] In some example embodiments, an apparatus capable of performing any of the methods 500 (e.g., the third network device 106) may include a component for performing the corresponding operations of the method 500. The component may be implemented in any suitable form. For example, the component may be implemented as a circuit system or a software module. The apparatus may be implemented as or included in the third network device 106. In some example embodiments, the component may include a processor and a memory.

[0231] In some example embodiments, the apparatus includes: a component for obtaining at least one conditional policy and charging control (C-PCC) rule from operation and maintenance at a third network device, the at least one C-PCC rule being determined based on at least an SLA of the network slice; a component for sending at least one condition in the at least one C-PCC rule to the first network device, the at least one condition being used to trigger adjustment of security control of the network slice; a component for receiving a message from the first network device indicating that the at least one condition is met or not met; and a component for adjusting the security control of the network slice based on the message.

[0232] In some example embodiments, at least one C-PCC rule includes at least one of: at least one condition for triggering adjustment of a security control; an indication of a target of at least one of: at least one network function for enforcing at least one security policy for adjusting for changes in performance, or at least one network interface between network functions for enforcing the C-PCC rule, an indication of a scope of at least one object that will be affected by enforcement of the at least one C-PCC rule, or at least one security policy adjustment action for adjusting for changes in performance.

[0233] Figure 10 is a simplified block diagram of a device 1000 suitable for implementing an example embodiment of the present disclosure. The device 1000 may be provided to implement a communication device, such as Figure 1 10. As shown in FIG, the first network device 102, the second network device 104, or the third network device 1026. As shown, the device 1000 includes one or more processors 1010, one or more memories 1020 coupled to the processors 1010, and one or more communication modules 1040 coupled to the processors 1010.

[0234] The communication module 1040 is configured for bidirectional communication. The communication module 1040 has one or more communication interfaces to facilitate communication with one or more other modules or devices. A communication interface may represent any interface required to communicate with other network elements. In some example embodiments, the communication module 1040 may include at least one antenna.

[0235] Processor 1010 can be of any type suitable for use in a local technology network and can include one or more of the following: as non-limiting examples, a general-purpose computer, a special-purpose computer, a microprocessor, a digital signal processor (DSP), and a processor based on a multi-core processor architecture. Device 1000 can have multiple processors, such as application-specific integrated circuit chips that are time-slave to a clock synchronized with a main processor.

[0236] The memory 1020 may include one or more non-volatile memories and one or more volatile memories. Examples of non-volatile memories include, but are not limited to, read-only memory (ROM) 1024, electrically programmable read-only memory (EPROM), flash memory, hard disks, compact disks (CDs), digital video disks (DVDs), optical disks, laser disks, and other magnetic and / or optical storage. Examples of volatile memories include, but are not limited to, random access memory (RAM) 1022 and other volatile memories that will not persist during a power outage.

[0237] Computer program 1030 includes computer-executable instructions that have been executed by associated processor 1010. Program 1030 may be stored in a memory, such as ROM 1024. Processor 1010 may perform any suitable actions and processes by loading program 1030 into RAM 1022.

[0238] The exemplary embodiments of the present disclosure may be implemented by the program 1030 so that the device 1000 can perform any process of the present disclosure, such as referring to Figures 1 to 9 The exemplary embodiments of the present disclosure may also be implemented by hardware or a combination of software and hardware.

[0239] In some example embodiments, program 1030 may be tangibly embodied in a computer-readable medium that may be included in device 1000 (such as in memory 1020) or in other storage devices accessible by device 1000. Device 1000 may load program 1030 from the computer-readable medium into RAM 1022 for execution. Computer-readable media may include any type of tangible, non-volatile storage, such as ROM, EPROM, flash memory, hard disk, CD, DVD, and the like. Figure 11 An example of a computer readable medium 1100 is shown, which may be in the form of a CD, DVD, or other optical storage disc.The computer readable medium has a program 1030 stored thereon.

[0240] In general, the various embodiments of the present disclosure may be implemented in hardware or dedicated circuits, software, logic, or any combination thereof. Some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software, which may be executed by a controller, microprocessor, or other computing device. Although various aspects of the embodiments of the present disclosure are shown and described as block diagrams, flow charts, or using some other graphical representations, it should be understood that, as non-limiting examples, the blocks, devices, systems, techniques, or methods described herein may be implemented in hardware, software, firmware, dedicated circuits or logic circuits, general-purpose hardware or a controller or other computing device, or some combination thereof.

[0241] The present disclosure also provides at least one computer program product tangibly stored on a non-transitory computer-readable storage medium. The computer program product includes computer-executable instructions (such as those included in program modules) that are executed in a device on a target physical or virtual processor to perform the operations described above with reference to Figures 1 to 9Any of the methods described. Typically, program modules include routines, programs, libraries, objects, classes, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The functions of program modules can be combined or split as needed in various embodiments. Machine-executable instructions for program modules can be executed in local or distributed devices. In distributed devices, program modules can be located in both local and remote storage media.

[0242] The program code for executing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device so that the program code, when executed by the processor or controller, causes the function / operation specified in the flow chart and / or block diagram to be realized. The program code can be executed entirely on the machine, partially on the machine, as an independent software package, partially on the machine and partially on a remote machine, or completely on a remote machine or server.

[0243] In the context of the present disclosure, computer program codes or related data may be carried by any suitable carrier to enable a device, apparatus or processor to perform the various processes and operations described above. Examples of carriers include signals, computer-readable media, etc.

[0244] The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media include an electrical connection having one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0245] It should be understood that although certain embodiments can be implemented by / at an IAB node, the solutions including the methods and devices proposed in the present disclosure can also be applied to other communication systems having similar technical problems. In addition, although the operations are described in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in a continuous order, or that all the operations shown be performed to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. Similarly, although several specific implementation details are included in the above discussion, these details should not be considered as limitations on the scope of the present disclosure, but rather as descriptions of features specific to a particular embodiment. Certain features described in the context of separate embodiments may also be implemented in combination in a single embodiment. On the contrary, the various features described in the context of a single embodiment may also be implemented separately in multiple embodiments or in any suitable sub-combination.

[0246] Although the present disclosure has been described in language specific to structural features and / or methodological acts, it should be understood that the present disclosure defined in the appended claims is not necessarily limited to the specific features or acts described above. Instead, the specific features and acts described above are disclosed as example forms of implementing the claims.

Claims

1. A first network device, comprising: at least one processor; as well as at least one memory storing instructions that, when executed by the at least one processor, cause the first network device to at least: Enables changes in the performance of network slices to be detected; as well as Adjusting the security controls of the network slice based on the change in the performance and a service level agreement (SLA) of the network slice is triggered to adjust the change in the performance.

2. The first network device of claim 1 , wherein the first network device is configured to trigger adjustment of the security control based on the change in the performance and at least one of: at least one Conditional Policy and Charging Control (C-PCC) rule determined based at least on the SLA, or Analysis of the performance of the network slice performed by the second network device.

3. The first network device according to claim 2, wherein the at least one C-PCC rule comprises at least one of the following: at least one condition for triggering adjustment of said security control, a target indicating at least one of: at least one network function that will enforce at least one security policy for adjusting the change in performance, or at least one network interface between network functions that will enforce the C-PCC rule, indicating a scope of at least one object to be affected by enforcement of the at least one C-PCC rule, or The at least one security policy adjustment action is used to adjust the change in the performance.

4. The first network device according to claim 3, wherein the at least one object comprises at least one of the following: The network slice, Packet Data Unit (PDU) session, or At least one terminal device connected to the network slice.

5. The first network device according to claim 3, wherein: The first network device enables the change in the performance of the network slice to be detected by acquiring performance data of the network slice; The first network device is further configured to: Obtaining the at least one C-PCC rule from operations and maintenance; and The first network device is caused to trigger adjusting the security control by: Based on determining whether the at least one condition is met or not met, at least one PCC rule for adjusting the change in performance is sent to a third network device, wherein the third network device sends the at least one PCC rule to the network function of the network slice for enforcing the security control for the network slice.

6. The first network device according to claim 3, wherein: The first network device is further configured to: acquiring, from a third network device, the at least one condition in the at least one C-PCC rule; and The first network device is caused to trigger adjusting the security control by: Based on determining that the at least one condition is satisfied or not satisfied, at least a message is sent indicating that the at least one condition is satisfied or not satisfied.

7. The first network device of claim 2 , wherein the first network device causes the change in the performance of the network slice to be detected by: Sending a request to the second network device for a recommendation for the security control based on the analysis of the performance of the network slice.

8. The first network device according to claim 7, wherein the request comprises at least one of the following: The type of analysis being conducted, an identifier of the network slice, or At least one interface between network functions, and performance data of the network slice is obtained from the network functions.

9. The first network device of claim 8, wherein the first network device is configured to trigger adjusting the security control by: receiving a response to the request from the second network device, the response including at least a security policy for the network slice; and Send the security policy to a third network device for the security control of the network slice.

10. The first network device according to claim 9, wherein the response further comprises at least one of the following: said type of said analysis, said identifier of said network slice, at least one interface between network functions from which performance data of the network slice is obtained, at least one object to be affected by enforcement of said security policy, The duration during which the security policy will be enforced, the cause of the said change in performance, or The confidence level of the security policy.

11. The first network device according to claim 2, wherein: The first network device is further configured to: Acquire at least one condition in the at least one C-PCC rule from a third network device, or acquire the at least one C-PCC rule from operation and maintenance, where the at least one condition is used to trigger adjustment of the security control; as well as The first network device is caused to trigger adjusting the security control by: Sending a request for the analysis of the performance of the network slice to the second network device; receiving, from the second network device, an analysis report related to the performance of the network slice; as well as Adjusting the security control is triggered based on the at least one C-PCC rule and the analysis report.

12. The first network device according to claim 11, wherein the analysis report comprises at least one of the following: an identifier of the performance issue with the network slice, The type of performance issue in question, or At least one object affected by the performance issue.

13. The first network device of claim 12, wherein the first network device is caused to trigger adjusting the security control based on the at least one C-PCC rule and the analysis report by: obtaining the type of the performance issue and the at least one object from the analysis report based on determining that the identifier of the performance issue matches an identifier of a first C-PCC rule in the at least one C-PCC rule; determining the first C-PCC rule based on the identifier of the first C-PCC rule; obtaining at least one security policy adjustment action in the first C-PCC rule based on determining that the type of the performance issue matches a target in the first C-PCC rule and the at least one object matches an object in a scope in the first C-PCC rule; as well as Adjusting the security control is triggered based on the at least one security policy adjustment action.

14. The first network device of claim 13, wherein the first network device is caused to trigger adjusting the security control based on the at least one security policy adjustment action by: Based on the at least one security policy adjustment action, a notification is sent to the third network device that a security policy for the object in the scope of the first C-PCC rule will be updated.

15. A second network device, comprising: at least one processor; as well as at least one memory storing instructions that, when executed by the at least one processor, cause the second network device to at least: receiving a request for analysis of the network slice from the first network device; obtaining performance data of the network slice based at least on the request; as well as Based at least on the request and the performance data, generate a security policy for the network slice or an analysis report related to the performance of the network slice.

16. The second network device of claim 15, wherein the request comprises: A request for recommendations for security controls for the network slice based on an analysis of the performance of the network slice.

17. The second network device according to claim 16, wherein the request comprises at least one of the following: the type of analysis being conducted; an identifier of the network slice; or At least one interface between network functions, and the performance data of the network slice is obtained from the network function.

18. The second network device according to claim 17, wherein the second network device is further configured to: Send a response to the request to the first network device, the response including at least the security policy for the network slice.

19. The second network device according to claim 18, wherein the response further comprises at least one of the following: said type of said analysis, said identifier of said network slice, the at least one interface between network functions, the performance data of the network slice being obtained from the network functions, at least one object to be affected by enforcement of said security policy, The duration during which the security policy will be enforced, the reason for the change in the performance of the network slice, or The confidence level of the security policy.

20. The second network device of claim 15, wherein the second network device is further configured to: Sending a response to the request to the first network device, wherein the response includes the analysis report, and the analysis report includes at least one of the following: an identifier of the performance issue with the network slice, The type of performance issue in question, or At least one object affected by the performance issue.

21. The second network device of claim 20, wherein the request indicates a service area of ​​the network slice for which the performance data is to be obtained.

22. The second network device according to claim 20, wherein the performance data comprises at least one of the following: The end-to-end latency between the application function (AF) and the terminal device connected to the network slice, the round trip time between the User Plane Function (UPF) and the terminal device, a first difference between the end-to-end delay and the round-trip time, a second difference between the round trip time and an average uplink packet delay or downlink packet delay, the packet delay being the delay between a packet data unit session anchor (PSA) UPF and the terminal device, or The uplink latency or downlink latency in the user plane of the centralized unit in the network slice.

23. A third network device, comprising: at least one processor; as well as at least one memory storing instructions that, when executed by the at least one processor, cause the third network device to at least: Retrieve at least one policy and charging control (PCC) rule from the first network device, the at least one PCC rule being determined based on at least a service level agreement (SLA) of the network slice; as well as Adjusting security control of the network slice based on the at least one PCC rule.

24. The third network device according to claim 23, wherein the at least one PCC rule comprises at least one of the following: a target indicating at least one network function that will enforce at least one security policy adjustment action for adjusting a change in performance of the network slice, and / or at least one network interface between network functions that will enforce the PCC rule, indicating a scope of at least one object to be affected by said enforcement of said at least one PCC rule, or The at least one security policy adjustment action is used to adjust the change in the performance.

25. A third network device, comprising: at least one processor; as well as at least one memory storing instructions that, when executed by the at least one processor, cause the third network device to at least: Retrieve at least one conditional policy and charging control (C-PCC) rule from operations and maintenance, the at least one C-PCC rule being determined based on at least a service level agreement (SLA) for the network slice; Sending at least one condition in the at least one C-PCC rule to the first network device, where the at least one condition is used to trigger adjusting the security control of the network slice; receiving a message from the first network device indicating that at least one condition is satisfied or not satisfied; as well as Adjusting the security control of the network slice based on the message.

26. The third network device according to claim 25, wherein the at least one C-PCC rule comprises at least one of the following: the at least one condition for triggering adjustment of the security control; a target indicating at least one of: at least one network function that will enforce at least one security policy for adjusting the change in performance, or at least one network interface between network functions that will enforce the C-PCC rule, indicating a scope of at least one object to be affected by enforcement of the at least one C-PCC rule, or The at least one security policy adjustment action is used to adjust the change in the performance.

27. A method comprising: causing, at the first network device, a change in performance of the network slice to be detected; as well as Adjusting the security controls of the network slice based on the change in the performance and a service level agreement (SLA) of the network slice is triggered to adjust the change in the performance.

28. A method comprising: receiving, at the second network device from the first network device, a request for analysis of the network slice; obtaining performance data of the network slice based at least on the request; as well as Based at least on the request and the performance data, generate a security policy for the network slice or an analysis report related to the performance of the network slice.

29. A method comprising: obtaining, at the third network device, at least one policy and charging control (PCC) rule from the first network device, the at least one PCC rule being determined based on at least a service level agreement (SLA) for the network slice; as well as Adjusting security control of the network slice based on the at least one PCC rule.

30. A method comprising: Retrieve, at a third network device, at least one conditional policy and charging control (C-PCC) rule from operations and maintenance, the at least one C-PCC rule being determined based on at least a service level agreement (SLA) for the network slice; Sending at least one condition in the at least one C-PCC rule to the first network device, where the at least one condition is used to trigger adjusting the security control of the network slice; receiving a message from the first network device indicating that at least one condition is satisfied or not satisfied; as well as Adjusting the security control of the network slice based on the message.

31. A non-transitory computer-readable medium comprising program instructions, which, when executed by a device, cause the device to at least perform the method according to claims 27 to 30.

Images