Core network node, MEC server, external server, communication system, control method, program, and non-transitory recording medium having program recorded thereon

Abstract

[Problem] To achieve appropriate accommodation of a terminal device on the basis of security information. [Solution] A core network node 350 belonging to a core network forming a plurality of network slices is provided with a communication processing unit which, on the basis of security information related to the security of a terminal device 100, transmits to the terminal device 100 a command indicating a parameter related to a network slice into which the terminal device 100 is to be accommodated.

Description

[Technical Field]

[0001] The present invention relates to a core network node, an MEC server, an external server, a communication system, a control method, a program, and a non-transitory recording medium on which a program is recorded. [Background technology]

[0002] In recent years, the Internet of Things (IoT), in which various "things" are connected to the Internet, has become widespread, and the diversification of services provided via the network has led to an increase in communication traffic. To address this situation, the introduction of the fifth-generation mobile communication system (hereinafter referred to as 5G) is progressing in various countries.

[0003] Conventional 3G / 4G are operated by specific mobile network operators and provide communication services to mobile terminals such as mobile phones and smartphones. On the other hand, compared to 3G / 4G, 5G is expected to involve the participation of a wider variety of operators and allow simultaneous connections from a wider variety of devices (e.g., Non-Patent Document 1). [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] 3GPP TR 38.913 - Technical Specification Group Radio Access Network; Study on Scenarios and Requirements for Next Generation Access Technologies Summary of the Invention [Problem to be solved by the invention]

[0005] Conventionally, network security technologies such as intrusion detection systems, firewalls, and intrusion prevention systems have been used to respond to cyber attacks. However, 5G security requires addressing new situations such as the increase in communication traffic and multiple simultaneous connections mentioned above.

[0006] Therefore, 5G requires that the system maintain more network facilities than before, and that the diverse devices and operators connected to the system be managed appropriately.There is currently a need to develop security technologies suitable for wireless communication systems such as 5G, which have the above characteristics.

[0007] In view of the above circumstances, an object of the present invention is to provide a core network node, an MEC server, an external server, a communication system, a control method, a program, and a non-transitory recording medium on which the program is recorded, which are capable of realizing appropriate accommodation based on security information. [Means for solving the problem]

[0008] A core network node according to one embodiment of the present invention is a core network node belonging to a core network that forms multiple network slices, and is equipped with a communication processing unit that transmits a command to a terminal device indicating parameters related to the network slice that should accommodate the terminal device based on security information related to the security of the terminal device.

[0009] A MEC (Mobile Edge Computing) server according to one embodiment of the present invention is an MEC server that belongs to a core network that forms multiple network slices or is capable of communicating with a core network that forms multiple network slices, and is equipped with a communication processing unit that transmits a message including security information regarding the security of a terminal device to a core network node that belongs to the core network.

[0010] An external server according to one embodiment of the present invention is an external server capable of communicating with a core network that forms multiple network slices, and is equipped with a communication processing unit that transmits a message including security information regarding the security of a terminal device to a core network node belonging to the core network.

[0011] A communication system according to one aspect of the present invention is a communication system comprising a core network node belonging to a core network that forms multiple network slices, wherein the core network node comprises a communication processing unit that transmits a command to a terminal device indicating parameters related to the network slice that should accommodate the terminal device based on security information related to the security of the terminal device.

[0012] A communication system according to one embodiment of the present invention is a communication system comprising: a core network node belonging to a core network that forms multiple network slices; and an MEC server that belongs to the core network or is capable of communicating with the core network, wherein the MEC server comprises a communication processing unit that transmits a message to the core network node including security information regarding the security of a terminal device; and the core network node comprises a communication processing unit that transmits a command to the terminal device indicating parameters regarding the network slice that should accommodate the terminal device based on the security information from the MEC server.

[0013] A communication system according to one embodiment of the present invention is a communication system comprising a core network node belonging to a core network that forms multiple network slices, and an external server capable of communicating with the core network, wherein the external server comprises a communication processing unit that transmits a message to the core network node including security information regarding the security of a terminal device, and the core network node comprises a communication processing unit that transmits a command to the terminal device indicating parameters regarding the network slice that should accommodate the terminal device based on the security information from the external server.

[0014] A control method according to one aspect of the present invention is a control method for a core network node belonging to a core network that forms multiple network slices, and comprises sending a command to a terminal device indicating parameters related to the network slice that should accommodate the terminal device based on security information related to the security of the terminal device.

[0015] A program according to one aspect of the present invention causes a computer to function as a core network node belonging to a core network that forms multiple network slices, and that has a communication processing unit that transmits to a terminal device a command indicating parameters related to the network slice that should accommodate the terminal device based on security information related to the security of the terminal device.

[0016] A non-transitory recording medium according to one embodiment of the present invention records a program that causes a computer to function as a core network node that belongs to a core network that forms multiple network slices and has a communication processing unit that sends a command to a terminal device indicating parameters related to the network slice that should accommodate the terminal device based on security information related to the security of the terminal device.

[0017] A core network node according to one embodiment of the present invention is a core network node belonging to a core network that forms multiple network slices, and comprises a detection unit that detects security threats based on signals transmitted and received by nodes managed by a specific operator, and a communication processing unit that controls the specific operator to be accommodated in another network slice based on the detected threat.

[0018] An MEC server according to one embodiment of the present invention is an MEC (Mobile Edge Computing) server that belongs to a core network that forms multiple network slices or is capable of communicating with a core network that forms multiple network slices, and is equipped with a detection unit that detects security threats based on signals sent and received by nodes managed by a specific operator, and a communication processing unit that sends a message including security information indicating the detected threat to a core network node that belongs to the core network.

[0019] An external server according to one embodiment of the present invention is an external server capable of communicating with a core network forming multiple network slices, and includes a detection unit that detects security threats based on signals sent and received by nodes managed by a specific operator, and a communication processing unit that sends a message including security information indicating the detected threat to a core network node belonging to the core network.

[0020] A communication system according to one embodiment of the present invention is a communication system comprising a core network node belonging to a core network forming multiple network slices, wherein the core network node comprises a communication processing unit that controls the accommodation of a specific operator in another network slice based on a security threat detected based on signals transmitted and received by nodes managed by the specific operator.

[0021] A control method according to one aspect of the present invention is a control method for a core network node belonging to a core network that forms multiple network slices, and includes controlling a specific operator to be accommodated in another network slice based on a security threat detected based on signals transmitted and received by nodes managed by the specific operator.

[0022] A program according to one aspect of the present invention causes a computer to function as a core network node belonging to a core network that forms multiple network slices, the core network node having a communication processing unit that controls a specific operator to be accommodated in another network slice based on a security threat detected based on signals sent and received by a node managed by the specific operator.

[0023] A non-transitory recording medium according to one embodiment of the present invention records a program that causes a computer to function as a core network node belonging to a core network that forms multiple network slices, the core network node having a communication processing unit that controls a specific operator to be accommodated in another network slice based on a security threat detected based on signals sent and received by a node managed by the specific operator. [Effects of the Invention]

[0024] According to the present invention, it is possible to realize a process of accommodating a device in an appropriate network slice based on security information. Note that the present invention may achieve other effects instead of or in addition to the effect described above. [Brief explanation of the drawings]

[0025] [Figure 1] 1 is an explanatory diagram illustrating a schematic configuration of a communication system S1 according to a first embodiment of the present invention. [Figure 2] 1 is a block diagram illustrating a schematic configuration of a terminal device 100 according to a first embodiment of the present invention. [Figure 3]1 is a block diagram illustrating a schematic configuration of a base station 200 according to a first embodiment of the present invention. [Figure 4] 1 is a block diagram illustrating a schematic configuration of a core network 30 according to a first embodiment of the present invention. [Figure 5] 1 is an explanatory diagram illustrating the architecture of a core network 30 according to a first embodiment of the present invention. [Figure 6] 1 is a block diagram illustrating a schematic configuration of a core network node 300 according to a first embodiment of the present invention. [Figure 7] 2 is a block diagram illustrating a schematic configuration of an access management node 350 according to the first embodiment of the present invention. FIG. [Figure 8] 1 is a block diagram illustrating a schematic configuration of an MEC server 400 according to a first embodiment of the present invention. [Figure 9] 1 is a block diagram illustrating a schematic configuration of an external server 500 according to a first embodiment of the present invention. [Figure 10] FIG. 1 is an explanatory diagram illustrating conventional S-NSSAI and SST. [Figure 11] FIG. 3 is a sequence diagram showing a first operation example in the first embodiment of the present invention. [Figure 12] FIG. 10 is a sequence diagram showing another first operation example in the first embodiment of the present invention. [Figure 13] FIG. 10 is a sequence diagram showing a second operation example in the first embodiment of the present invention. [Figure 14] FIG. 10 is a sequence diagram showing a third operation example in the first embodiment of the present invention. [Figure 15] FIG. 10 is a block diagram illustrating a schematic configuration of an access management node 350a according to a second embodiment of the present invention. [Figure 16] FIG. 10 is a block diagram illustrating a schematic configuration of an MEC server 400a according to a second embodiment of the present invention. [Figure 17] FIG. 10 is a block diagram illustrating a schematic configuration of an external server 500a according to a second embodiment of the present invention. [Figure 18]FIG. 10 is a block diagram schematically illustrating a first configuration of a communication system S1a according to a second embodiment of the present invention. [Figure 19] FIG. 10 is a block diagram schematically illustrating a second configuration of a communication system S1a according to a second embodiment of the present invention. [Figure 20] FIG. 10 is a block diagram schematically illustrating a third configuration of a communication system S1a according to a second embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0026] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. In this specification and drawings, elements that can be similarly described will be designated by the same reference numerals, and redundant description will be omitted.

[0027] The embodiments described below are merely examples of configurations that can realize the present invention. Each of the following embodiments can be modified or changed as appropriate depending on the configuration of the device to which the present invention is applied and various conditions. Not all of the combinations of elements included in each of the following embodiments are necessarily essential to realize the present invention, and some of the elements can be omitted as appropriate. Therefore, the scope of the present invention is not limited to the configurations described in each of the following embodiments. As long as there are no mutual contradictions, configurations that combine multiple configurations described in the embodiments can also be adopted.

[0028] The description of the present invention will be given in the following order. 1. Overview of the Embodiments of the Invention 2. First embodiment 2.1. Configuration of communication system S1 2.2. Configuration of the Terminal Device 100 2.3. Configuration of base station 200 2.4. Core Network 30 Configuration 2.4.1. General Core Network Node 300 Configuration 2.4.2. Configuring the Access Management Node 350 2.5. MEC Server 400 Configuration 2.6. Configuration of External Server 500 2.7. Working example 2.7.1. First working example 2.7.2. Second working example 2.7.3. Third working example 2.8. Variations 3. Second embodiment 3.1. Configuration and Operation Example of Access Management Node 350a 3.2. Configuration and Operation Example of MEC Server 400a 3.3. Configuration and Operation Example of External Server 500a 3.4.1. First Configuration and Operation Example of Communication System S1a 3.4.2. Second Configuration and Operation Example of Communication System S1a 3.4.3. Third Configuration and Operation Example of Communication System S1a 4. Other Embodiments

[0029] <<1. Overview of the embodiment of the present invention>> First, an outline of the embodiment of the present invention will be described.

[0030] (1)Technical issues In recent years, the Internet of Things (IoT), in which various "things" are connected to the Internet, has become widespread, and the diversification of services provided via the network has led to an increase in communication traffic. To address this situation, the introduction of the fifth-generation mobile communication system (hereinafter referred to as 5G) is progressing in various countries.

[0031] Conventional 3G / 4G networks are operated by specific mobile network operators and provide communication services to mobile devices such as cell phones and smartphones. On the other hand, 5G is expected to involve a wider variety of operators and allow simultaneous connections from a wider variety of devices than 3G / 4G.

[0032] Conventionally, network security technologies such as intrusion detection systems, firewalls, and intrusion prevention systems have been used. However, 5G security requires addressing new situations such as the increase in communication traffic and multiple simultaneous connections mentioned above.

[0033] Therefore, 5G requires that the system maintain more network facilities than before, and that the wide variety of devices connected to the system be managed appropriately. Currently, there is a demand for the development of security technologies suitable for wireless communication systems such as 5G, which have the above characteristics.

[0034] In view of the above circumstances, this embodiment aims to realize appropriate accommodation of terminal devices based on security information. In particular, this embodiment focuses on messaging suitable for network slicing defined in 5G network architecture specifications (<References> 3GPP TS 23.501, 3GPP TS 23.502, etc.). Network slicing is a technology that logically (virtually) divides the same network physical facility and combines the divided logical facilities (virtual resources) to configure a logical communication network called a network slice (or slice).

[0035] (2) Technical Features In an embodiment of the present invention, a core network node belonging to a core network forming a plurality of network slices transmits a command to a terminal device indicating parameters related to a network slice that should accommodate the terminal device, based on security information related to the security of the terminal device. The core network node may acquire the security information itself.

[0036] In one aspect of an embodiment of the present invention, an MEC server belonging to a core network forming multiple network slices or capable of communicating with a core network forming multiple network slices transmits a message including security information regarding the security of a terminal device to a core network node belonging to the core network.

[0037] In one aspect of an embodiment of the present invention, an external server capable of communicating with a core network forming multiple network slices transmits a message including security information regarding the security of a terminal device to a core network node belonging to the core network.

[0038] According to the above configuration, it is possible to realize the process of accommodating in an appropriate network slice based on security information.

[0039] It should be noted that this embodiment may achieve other effects instead of or in addition to the effect. The above-described technical features are specific examples of the embodiment of the present invention, and it goes without saying that the embodiment of the present invention is not limited to the above-described technical features.

[0040] <<2. First Embodiment>> Next, a first embodiment of the present invention will be described with reference to FIGS.

[0041] <<2.1. Configuration of communication system S1>> Fig. 1 is an explanatory diagram illustrating a schematic configuration of a communication system S1 according to this embodiment. As shown in Fig. 1, the communication system S1 according to this embodiment includes a terminal device 100, a base station 200, a core network 30, a MEC (Mobile Edge Computing) server 400, and an external server 500. The core network 30 includes a plurality of core network nodes 300. The external server 500 is a server device located outside the mobile communication system MCS (core network 30) and is communicably connected to the core network 30.

[0042] The mobile communication system MCS is, for example, a system that complies with the Technical Specification (TS) of 3GPP (3rd Generation Partnership Project). More specifically, the mobile communication system MCS may be a fifth-generation (5G) mobile communication system that complies with the fifth-generation (5G) technical specifications. The mobile communication system MCS may also be a local 5G that is privately constructed by an individual operator that is not a telecommunications carrier. The mobile communication system MCS is included in the communication system S1. Naturally, the configuration of the communication system S1 is not limited to this example.

[0043] <<2.2. Configuration of Terminal Device 100>> The terminal device 100 is a node that performs wireless communication with the base station 200. The terminal device 100 may be, for example, a mobile phone terminal such as a smartphone, a communication module mounted on an autonomous vehicle, or a communication module mounted on an IoT device such as a surveillance camera or a robot. That is, the terminal device 100 may be a node for enhanced Mobile Broadband (eMBB), a node for Ultra-Reliable and Low Latency Communications (URLLC), a node for massive Machine Type Communications (mMTC), or a node for vehicular communications (Vehicle to X, V2X).

[0044] 2 is a block diagram illustrating a schematic configuration of the terminal device 100 according to this embodiment. As shown in FIG. 2, the terminal device 100 includes a wireless communication unit 110, a storage unit 120, and a processing unit .

[0045] The wireless communication unit 110 is an element that performs wireless communication with the base station 200. The wireless communication unit 110 transmits wireless signals to the base station 200 and receives wireless signals from the base station 200. The wireless communication unit 110 can be implemented by, for example, an antenna and a radio frequency (RF) circuit.

[0046] The storage unit 120 is an element that temporarily or permanently stores programs (instructions) and data used to execute various processes in the terminal device 100. The programs include one or more instructions for operating the terminal device 100. The storage unit 120 may be implemented, for example, by a storage medium such as a volatile memory, a non-volatile memory, or a magnetic disk, or a combination of two or more of these. Furthermore, the storage unit 120 may be configured integrally with one or more processors that constitute the processing unit 130.

[0047] The processing unit 130 is an element that provides various functions of the terminal device 100, and has a control unit 131 and a communication processing unit 132 as functional blocks. Generally speaking, the control unit 131 controls the processing of the terminal device 100, and the communication processing unit 132 executes communication processing with other nodes such as the base station 200. Note that the processing unit 130 may further include components other than the above functional blocks. That is, the processing unit 130 can execute operations other than those performed by the above functional blocks.

[0048] The processing unit 130 may be implemented by one or more processors such as a baseband processor, for example. The processing unit 130 may implement the processing of this embodiment, which will be described later, by loading a program stored in the storage unit 120 into the storage unit 120 and / or a system memory (not shown) and executing the program. Note that each functional block (the control unit 131 and the communication processing unit 132) may be implemented by one or more processors separate from the processing unit 130. The processing unit 130 may be implemented within an SoC (System on Chip).

[0049] <<2.3. Configuration of base station 200>> The base station 200 is a node that performs wireless communication with the terminal device 100, that is, a node of a radio access network (RAN). The base station 200 may be, for example, an evolved Node B (eNB) or a generation Node B (gNB) in 5G.

[0050] 3 is a block diagram illustrating a schematic configuration of a base station 200 according to this embodiment. As shown in FIG. 3, the base station 200 includes a wireless communication unit 210, a network communication unit 220, a storage unit 230, and a processing unit 240.

[0051] The wireless communication unit 210 is an element that performs wireless communication with the terminal device 100. The wireless communication unit 210 transmits wireless signals to the terminal device 100 and receives wireless signals from the terminal device 100. The wireless communication unit 210 can be implemented by, for example, an antenna and a radio frequency (RF) circuit.

[0052] The network communication unit 220 is an element that communicates with the core network 30. The network communication unit 220 transmits signals to the core network 30 and receives signals from the core network 30. The network communication unit 220 can be implemented by, for example, a network adapter and / or a network interface card.

[0053] The storage unit 230 is an element that temporarily or permanently stores programs (instructions) and data used to execute various processes in the base station 200. The programs include one or more instructions for operating the base station 200. The storage unit 230 may be implemented by, for example, a storage medium such as a volatile memory, a non-volatile memory, or a magnetic disk, or a combination of two or more of these. Alternatively, the storage unit 230 may be configured integrally with one or more processors that constitute the processing unit 240.

[0054] The processing unit 240 is an element that provides various functions of the base station 200, and has a control unit 241 and a communication processing unit 242 as functional blocks. Generally speaking, the control unit 241 controls the processing of the base station 200, and the communication processing unit 242 executes communication processing with other nodes such as the terminal device 100 and the core network node 300. Note that the processing unit 240 may further include components other than the above functional blocks. That is, the processing unit 240 can execute operations other than those performed by the above functional blocks.

[0055] The processing unit 240 may be implemented by one or more processors such as a baseband processor. The processing unit 240 may implement the processing of this embodiment, which will be described later, by loading a program stored in the storage unit 230 into the storage unit 230 and / or a system memory (not shown) and executing the program. Note that each functional block (the control unit 241 and the communication processing unit 242) may be implemented by one or more processors separate from the processing unit 240.

[0056] Note that the base station 200 may be virtualized. That is, the base station 200 may be implemented as a virtual machine. In the above case, the base station 200 (virtual machine) may operate as a virtual machine on a physical machine (hardware) including a processor, a memory, etc., and on a hypervisor.

[0057] <<2.4. Configuration of Core Network 30>> The core network 30 is, for example, a 5G core network (5GC), and is configured in part or in whole using network function virtualization (NFV) technology.

[0058] 4 is a block diagram illustrating a schematic configuration of the core network 30 according to this embodiment. As shown in FIG. 4, the core network 30 includes, as hardware, a server device SV, a storage device ST, and a network device NW.

[0059] The above-described hardware of the core network 30 is virtualized using NFV technology to configure multiple core network nodes (instances) 300. The following is a non-limiting list of types of core network nodes 300. -AMF(Access and Mobility Management Function) -SMF(Session Management Function) -PCF (Policy Control Function) -NSSF(Network Slice Selection Function) -AUSF(Authentication Server Function) -UDM (Unified Data Management) -UPF (User Plane Function)

[0060] At least some of the core network nodes 300 may be realized by physical devices that do not use NFV technology.

[0061] As shown in FIG. 4, the resources of the virtualized core network 30 can be divided into multiple network slices NS1, NS2, NS3, ..., each constituting a logical (virtual) network. That is, the core network 30 of this embodiment can form multiple network slices NS. The multiple network slices NS each have different network characteristics. Each network slice NS has multiple core network nodes 300. Note that there may be core network nodes 300 that do not belong to a network slice NS, and one core network node 300 may belong to multiple network slices NS.

[0062] 5 is an explanatory diagram illustrating an example of the architecture of the core network 30. The C-plane of the core network 30 includes the above-mentioned AMF, SMF, PCF, NSSF, AUSF, and UDM as network functions (core network nodes 300). The U-plane of the core network 30 includes the above-mentioned one or more UPFs as network functions (core network nodes 300). The UPF can be configured as a connection point with the MEC server 400 and external server 500, which will be described later.

[0063] <<2.4.1. General Configuration of Core Network Node 300>> Each of the core network nodes 300 is a functional element that provides a particular network function (service) in the core network 30.

[0064] 6 is a block diagram illustrating a schematic configuration of a core network node 300 according to this embodiment. As shown in FIG. 6, the core network node 300 includes a network communication unit 310, a storage unit 320, and a processing unit 330.

[0065] The network communication unit 310 is an element that communicates with other nodes inside and outside the core network 30. The network communication unit 310 transmits signals to other nodes and receives signals from other nodes. As described above, the network communication unit 310 can be implemented by resources of the core network 30 that are virtualized using NFV technology.

[0066] The memory unit 320 is an element that temporarily or permanently stores programs (instructions) and data used to execute various processes in the core network node 300. The programs include one or more instructions for the operation of the core network node 300. As described above, the memory unit 320 can be implemented by resources of the core network 30 that have been virtualized using NFV technology.

[0067] The processing unit 330 is an element that provides various functions of the core network node 300, and has a control unit 331 and a communication processing unit 333 as functional blocks. Schematically, the control unit 331 controls the processing of the core network node 300, and the communication processing unit 333 executes communication processing with other nodes. The processing unit 330 may further include components other than the above functional blocks. That is, the processing unit 330 can execute operations other than those performed by the above functional blocks. As described above, the processing unit 330 can be implemented by resources of the core network 30 that are virtualized using NFV technology.

[0068] <<2.4.2. Configuration of the Access Management Node 350>> The access management node 350 is, for example, an Access and Mobility Management Function (AMF) defined in the 3GPP technical specifications (for example, <References> 3GPP TS 23.501). The access management node 350 is a node that terminates the N2 interface of the C-plane, and provides registration management functions, connection management functions, and mobility management functions.

[0069] 7 is a block diagram illustrating a schematic configuration of an access management node 350 according to this embodiment. As shown in FIG. 7, the access management node 350 includes a network communication unit 310, a storage unit 320, and a processing unit 360. The configurations and functions of the network communication unit 310 and the storage unit 320 are similar to those of a general core network node 300.

[0070] The processing unit 360 has a control unit 331, a detection unit 332, and a communication processing unit 333. The configurations and functions of the control unit 331 and the communication processing unit 333 are similar to those of a general core network node 300. In general, the detection unit 332 detects the state and information relating to the security of nodes such as the terminal device 100.

[0071] It should be noted that the functions of the access management node 350 according to this embodiment may be realized by other network function instances.

[0072] <<2.5. Configuration of MEC Server 400>> The MEC server 400 is a server that belongs to the core network 30, and provides predetermined services to the terminal device 100. The MEC server 400 is arranged closer to the terminal device 100 than a general server, and thereby can provide services to the terminal device 100 more efficiently.

[0073] 8 is a block diagram illustrating a schematic configuration of the MEC server 400 according to this embodiment. As shown in FIG. 8, the MEC server 400 includes a network communication unit 410, a storage unit 420, and a processing unit 430.

[0074] The network communication unit 410 is an element that communicates with the core network 30. The network communication unit 410 transmits signals to the core network 30 and receives signals from the core network 30. The network communication unit 410 can be implemented by, for example, a network adapter and / or a network interface card.

[0075] The storage unit 420 is an element that temporarily or permanently stores programs (instructions) and data used to execute various processes in the MEC server 400. The programs include one or more instructions for operating the MEC server 400. The storage unit 420 may be implemented, for example, by a storage medium such as a volatile memory, a nonvolatile memory, or a magnetic disk, or a combination of two or more of these. The storage unit 420 may also be configured integrally with one or more processors that constitute the processing unit 430.

[0076] The processing unit 430 is an element that provides various functions of the MEC server 400, and has a control unit 431, a detection unit 432, and a communication processing unit 433 as functional blocks. Schematically, the control unit 431 controls the processing of the MEC server 400, the detection unit 432 detects the security status and information of nodes such as the terminal device 100, and the communication processing unit 433 executes communication processing with other nodes such as the core network node 300. Note that the processing unit 430 may further include components other than the above functional blocks. That is, the processing unit 430 can execute operations other than those performed by the above functional blocks.

[0077] The processing unit 430 may be implemented by, for example, one or more processors. The processing unit 430 may implement the processing of this embodiment, which will be described later, by loading a program stored in the storage unit 420 into the storage unit 420 and / or a system memory (not shown) and executing the program. Note that each functional block (the control unit 431, the detection unit 432, and the communication processing unit 433) may be implemented by one or more processors separate from the processing unit 430.

[0078] The MEC server 400 (network communication unit 410, storage unit 420, and processing unit 430) may be implemented by virtualized resources using NFV technology. The MEC server 400 may also be configured to communicate with the base station 200 instead of the core network 30. That is, the MEC server 400 may be configured to be able to communicate with the core network 30 via the base station 200.

[0079] <<2.6. Configuration of the External Server 500>> The external server 500 is a server located outside the core network 30. The external server 500 is a device that provides a service to the terminal device 100 via the core network 30 or via another network such as the Internet.

[0080] 9 is a block diagram illustrating a schematic configuration of the external server 500 according to this embodiment. As shown in FIG. 9, the external server 500 includes a network communication unit 510, a storage unit 520, and a processing unit 530.

[0081] The network communication unit 510 is an element that communicates with the core network 30. The network communication unit 510 transmits signals to the core network 30 and receives signals from the core network 30. The network communication unit 510 can be implemented by, for example, a network adapter and / or a network interface card.

[0082] The storage unit 520 is an element that temporarily or permanently stores programs (instructions) and data used to execute various processes in the external server 500. The programs include one or more instructions for operating the external server 500. The storage unit 520 may be implemented by, for example, a storage medium such as a volatile memory, a non-volatile memory, or a magnetic disk, or a combination of two or more of these. Furthermore, the storage unit 520 may be configured integrally with one or more processors that constitute the processing unit 530.

[0083] The processing unit 530 is an element that provides various functions of the external server 500, and has a control unit 531, a detection unit 532, and a communication processing unit 533 as functional blocks. Schematically, the control unit 531 controls the processing of the external server 500, the detection unit 532 detects the security status and information of nodes such as the terminal device 100, and the communication processing unit 533 executes communication processing with other nodes such as the core network node 300. Note that the processing unit 530 may further include components other than the above functional blocks. That is, the processing unit 530 can execute operations other than those performed by the above functional blocks.

[0084] The processing unit 530 may be implemented by, for example, one or more processors. The processing unit 530 may implement the processing of this embodiment, which will be described later, by loading a program stored in the storage unit 520 into the storage unit 520 and / or a system memory (not shown) and executing the program. Note that each functional block (the control unit 531, the detection unit 532, and the communication processing unit 533) may be implemented by one or more processors separate from the processing unit 530.

[0085] <<2.7. Example of operation>> Several operation examples of this embodiment will be described with reference to Figures 10 to 14. The following operation examples have in common that the communication processing unit 333 of the access management node 350 transmits to the terminal device 100 a command indicating parameters related to the network slice NS that should accommodate the terminal device 100, based on security information SI related to the security of the terminal device 100.

[0086] The command may include, for example, slice information that identifies a network slice NS that should accommodate the terminal device 100. The command may be, for example, a UE Configuration Update Command that updates the configuration of the terminal device 100 (User Equipment, UE). The slice information included in the command may include, for example, an NSSAI (Network Slice Selection Assistance Information) parameter that identifies a slice / service type (Slice / Service Type, SST).

[0087] The UE Configuration Update Command may comply with, for example, <References> 3GPP TS 23.502 (e.g., 4.2.4.2 UE Configuration Update procedure for access and mobility management related parameters). Furthermore, the NSSAI (e.g., S-NSSAI) specifying the SST may comply with, for example, <References> 3GPP TS 23.003 (e.g., 28.4.2 Format of the S-NSSAI) and <References> 3GPP TS 3GPP TS 23.501 (e.g., 5.15.2.2 Standardized SST values). The SST may indicate a value (SST Value) specifying eMBB, URLLC, mMTC (MIoT), V2X, etc. FIG. 10 is an explanatory diagram illustrating an S-NSSAI and an SST.

[0088] Here, as shown in Figure 10, conventional technical specifications only specify SSTs according to static characteristics of the network, but do not specify SSTs (and thus network slices NSs) according to detected threats and vulnerabilities (security information). Furthermore, conventional technical specifications do not specify the selection of network slices NSs according to detected threats and vulnerabilities (security information) (for example, <References> 3GPP TS 23.502, 4.2.4.2 UE Configuration Update procedure for access and mobility management related parameters).

[0089] <<2.7.1. First example of operation>> 11 and 12 are sequence diagrams showing a first operation example in this embodiment. Fig. 11 corresponds to an example in which the access management node 350 detects a vulnerability based on a control message from the terminal device 100, and Fig. 12 corresponds to an example in which the access management node 350 detects a threat based on the communication content of the terminal device 100.

[0090] 11, in step S110, the communication processing unit 132 of the terminal device 100 transmits a registration request message to the access management node 350 via the base station 200. The terminal device 100 may transmit the above registration request message to the access management node 350, for example, at the time of location registration. The above registration request message may include an N2 parameter indicating the security capability of the terminal device 100. The above registration request message is a C-plane message.

[0091] In step S120, the detection unit 332 of the access management node 350 detects vulnerabilities present in the terminal device 100 based on the security capabilities of the terminal device 100 indicated in the registration request message transmitted by the terminal device 100. The detection unit 332 notifies the communication processing unit 333 of the detected vulnerabilities as security information SI.

[0092] In step S130, the communication processing unit 333 of the access management node 350 transmits to the terminal device 100 a command indicating parameters related to the network slice NS that should accommodate the terminal device 100, based on the security information SI notified by the detection unit 332.

[0093] The command transmitted in step S130 may specify, for example, a quarantine network slice NS having a quarantine function. That is, the communication processing unit 333 may accommodate the terminal device 100 in a quarantine network slice having a quarantine function based on the security information SI.

[0094] Also, for example, the command transmitted in step S130 may identify a network slice NS having a security level corresponding to the security capability of the terminal device 100. That is, the communication processing unit 333 may accommodate the terminal device 100 in a network slice NS having a security level corresponding to the security information SI.

[0095] Thereafter, each node, including the terminal device 100, performs operations related to changing the configuration of the network slice NS based on the vulnerability detected as described above (i.e., the security information SI), thereby accommodating the terminal device 100 in an appropriate network slice NS.

[0096] Next, an example of Fig. 12 will be described. As shown in Fig. 12, in step S112, the communication processing unit 132 of the terminal device 100 transmits a signal on the C-plane to the access management node 350 via the base station 200. The signal may be, for example, an authentication-related control message or another control message.

[0097] In step S122, the detection unit 332 of the access management node 350 detects a threat to the terminal device 100 based on a signal on the C-plane transmitted by the terminal device 100 (i.e., the content of communication on the C-plane of the terminal device 100). The detection unit 332 notifies the communication processing unit 333 of the detected threat as security information SI. Note that the detection unit 332 may detect a vulnerability present in the terminal device 100 based on the content of communication on the C-plane of the terminal device 100.

[0098] In step S130, as in the example of Figure 11, the communication processing unit 333 of the access management node 350 transmits a command to the terminal device 100 indicating parameters related to the network slice NS that should accommodate the terminal device 100 based on the security information SI notified from the detection unit 332.

[0099] The operation caused by the command transmitted in step S130 is the same as the example in Fig. 11. That is, based on the security information SI, the terminal device 100 may be accommodated in a quarantine network slice having a quarantine function, or the terminal device 100 may be accommodated in a network slice NS having a security level according to the security information SI.

[0100] Furthermore, for example, the command sent in step S130 may be a command that realizes control such as disconnecting from the core network 30 the target of attack indicated by the threat included in the security information SI.

[0101] Thereafter, as in the example of Figure 11, each node including the terminal device 100 performs operations related to changing the configuration of the network slice NS based on the threats detected as described above (i.e., security information SI), thereby accommodating the terminal device 100 in an appropriate network slice NS.

[0102] <<2.7.2. Second example>> 13 is a sequence diagram showing a second operation example in this embodiment. FIG. 13 corresponds to an example in which the MEC server 400 detects a vulnerability or a threat based on the content of communication from the terminal device 100.

[0103] In step S210, the communication processing unit 132 of the terminal device 100 transmits and receives signals on the U-plane to and from the MEC server 400 via the UPF node 300. The signals may be, for example, user data constituting a website or other user data.

[0104] In step S220, the detection unit 432 of the MEC server 400 detects vulnerabilities present in the terminal device 100 or threats to the terminal device 100 based on signals on the U-plane transmitted and received by the terminal device 100 (i.e., communication content on the U-plane of the terminal device 100). The detection unit 432 can detect, for example, malware included in data on the U-plane of the terminal device 100 as a threat.

[0105] In step S230, the communication processing unit 433 of the MEC server 400 notifies the access management node 350 of the vulnerability or threat detected by the detection unit 432 as security information SI via the UPF node 300. The communication processing unit 433 may notify the access management node 350 of a request to change the network slice configuration including the above security information SI.

[0106] In step S240, similar to the examples of Figures 11 and 12, the communication processing unit 333 of the access management node 350 transmits a command to the terminal device 100 indicating parameters related to the network slice NS that should accommodate the terminal device 100, based on the security information SI notified from the MEC server 400.

[0107] In step S240, will be The operation caused by the command is similar to the examples in Figures 11 and 12. That is, based on the security information SI, the terminal device 100 may be accommodated in a quarantine network slice having a quarantine function, or the terminal device 100 may be accommodated in a network slice NS having a security level according to the security information SI. Also, the command transmitted in step S240 may be a command that realizes control such as disconnecting the target of attack indicated by the threat included in the security information SI from the core network 30.

[0108] Thereafter, as in the examples of Figures 11 and 12, each node including the terminal device 100 performs operations related to changing the configuration of the network slice NS based on the vulnerabilities or threats (i.e., security information SI) detected as described above, thereby accommodating the terminal device 100 in an appropriate network slice NS.

[0109] <<2.7.3. Third example>> 14 is a sequence diagram showing a third operation example in this embodiment. FIG. 14 corresponds to an example in which the external server 500 detects a vulnerability or a threat based on the content of communication from the terminal device 100.

[0110] In step S310, the communication processing unit 132 of the terminal device 100 transmits and receives signals on the C-plane and signals on the U-plane to and from the external server 500. The signals on the C-plane may be, for example, log data or other control messages. The signals on the U-plane may be, for example, user data constituting a website or other user data.

[0111] In step S320, the detection unit 532 of the external server 500 detects vulnerabilities present in the terminal device 100 or threats to the terminal device 100 based on signals on the C-plane and / or signals on the U-plane transmitted and received by the terminal device 100 (i.e., communication content on the C-plane and / or U-plane of the terminal device 100). The detection unit 532 can detect malware included in data on the U-plane of the terminal device 100 as a threat, for example. Alternatively, the detection unit 532 can detect threats by intercepting communication on the C-plane of the terminal device 100, for example.

[0112] In step S330, the communication processing unit 533 of the external server 500 notifies the access management node 350 of the vulnerability or threat detected by the detection unit 532 as security information SI. The communication processing unit 533 may transmit the security information SI to the access management node 350 via the UPF node 300 as a signal on the U-plane, or may transmit the security information SI to the access management node 350 as a signal on the C-plane. The communication processing unit 533 may notify the access management node 350 of a request to change the network slice configuration, including the above security information SI.

[0113] In step S340, as in the examples of Figures 11 and 12, the communication processing unit 333 of the access management node 350 sends a command to the terminal device 100 indicating parameters related to the network slice NS that should accommodate the terminal device 100, based on the security information SI notified from the external server 500.

[0114] In step S340, will be The operation caused by the command is similar to the examples in Figures 11 and 12. That is, based on the security information SI, the terminal device 100 may be accommodated in a quarantine network slice having a quarantine function, or the terminal device 100 may be accommodated in a network slice NS having a security level according to the security information SI. Also, the command transmitted in step S340 may be a command that realizes control such as disconnecting the target of attack indicated by the threat included in the security information SI from the core network 30.

[0115] Thereafter, as in the examples of Figures 11 and 12, each node including the terminal device 100 performs operations related to changing the configuration of the network slice NS based on the vulnerabilities or threats (i.e., security information SI) detected as described above, thereby accommodating the terminal device 100 in an appropriate network slice NS.

[0116] According to the configuration of the present embodiment described above, it is possible to realize the process of accommodating the terminal device 100 in an appropriate network slice based on the security information SI detected by the access management node 350, the MEC server 400, or the external server 500. In other words, according to the configuration of the present embodiment described above, it is possible to accommodate the terminal device 100 in an appropriate network slice.

[0117] In particular, even if a wide variety of terminal devices 100 are connected to the core network 30, the terminal devices 100 can be dynamically accommodated in an appropriate network slice NS, thereby avoiding the burden of individual setting management for each terminal device 100 and each operator that uses the terminal device 100. Consequently, the management load and management costs of the communication system S1 can be reduced.

[0118] In addition, dynamic allocation of network slices NS can be achieved according to detected vulnerabilities and threats, so the scale of hardware expansion (and therefore capital investment costs) can be reduced even if communication traffic increases.

[0119] <<2.8. Variations>> The above-described embodiment can be modified in various ways. Specific modified embodiments are exemplified below. Two or more embodiments arbitrarily selected from the above embodiment and the following examples can be combined as long as they are not mutually inconsistent.

[0120] A new network slice NS may be formed based on the detection of the above-mentioned vulnerability or threat. It is preferable to form a network slice NS that conforms to the security information SI indicating the vulnerability or threat (for example, a network slice NS having a security level corresponding to the level of the vulnerability or threat).

[0121] In the above-described embodiment, vulnerabilities and threats are detected based on signals transmitted and received by the terminal device 100 (signals on the C-plane or signals on the U-plane), and allocation of network slices NS is performed on a per-terminal device 100 basis.

[0122] However, in the above configuration, the control of the network slice NS is executed for each individual terminal device 100, so the processing granularity (control granularity) may be too fine. Therefore, in this modified example, the control of the network slice NS is executed on a per-operator basis, not on a per-terminal device 100 basis.

[0123] For example, when the detection unit 332 of the access management node 350, the detection unit 432 of the MEC server 400, or the detection unit 532 of the external server 500 detects a threat (attack) against a specific business operator, security information SI indicating the threat (attack) is supplied to the communication processing unit 333 of the access management node 350. The threat can be detected based on signals (signals on the C-plane or U-plane) transmitted and received by nodes managed by the specific business operator.

[0124] Based on the above security information SI provided, the communication processing unit 333 of the access management node 350 controls the specific operator to be accommodated in another network slice NS (for example, a network slice NS other than the network slice NS that is the target of attack indicated by the security information SI).

[0125] "Accommodating an operator in a network slice NS" may mean, for example, accommodating all or some of the nodes managed by a specific operator in the network slice NS. The nodes accommodated in the network slice NS may include a core network node 300 managed by a specific operator.

[0126] According to the configuration of this modified example described above, the control of the network slice NS is performed on an operator basis, making it possible to realize more efficient accommodation processing.

[0127] <<3. Second Embodiment>> Next, a second embodiment of the present invention will be described with reference to Figures 15 to 20. While the first embodiment described above is a specific embodiment, the second embodiment is a more generalized embodiment. According to the second embodiment described below, the same technical effects as those of the first embodiment can be achieved.

[0128] <<3.1. Configuration and Operation Example of Access Management Node 350a>> 15 is a block diagram illustrating a schematic configuration of an access management node 350a according to the second embodiment of the present invention. As shown in FIG. 15, the access management node 350a is a core network node belonging to a core network 30a that forms multiple network slices.

[0129] The communication processing unit 333a of the access management node 350a transmits a command to the terminal device indicating parameters related to the network slice that should accommodate the terminal device, based on security information related to the security of the terminal device.

[0130] The access management node 350a and the communication processing unit 333a may be implemented by resources of the core network 30a virtualized using NFV technology. Alternatively, the access management node 350a may be realized by a physical device that does not use NFV technology, and the communication processing unit 333a may be implemented by one or more processors, memory (e.g., non-volatile memory and / or volatile memory) and / or a hard disk. The memory may be included in the one or more processors or may be external to the one or more processors.

[0131] -Relationship with the first embodiment As an example, the communication processing unit 333a included in the access management node 350a according to the second embodiment may execute the operation of the communication processing unit 333 included in the access management node 350 according to the first embodiment. In the above case, the description of the first embodiment is also applicable to the second embodiment. Note that the second embodiment is not limited to the above example.

[0132] <<3.2. Configuration and Operation Example of MEC Server 400a>> 16 is a block diagram illustrating a schematic configuration of an MEC server 400a according to the second embodiment of the present invention. As shown in FIG. 16, the MEC server 400 belongs to a core network 30a that forms multiple network slices. The MEC server 400a may be provided outside the core network 30a so as to be able to communicate with the core network 30a.

[0133] The communication processing unit 433a of the MEC server 400a transmits a message including security information relating to the security of the terminal device to a core network node belonging to the core network 30a.

[0134] The MEC server 400a and the communication processing unit 433a may be implemented by resources of the core network 30a virtualized using NFV technology. Alternatively, the MEC server 400a may be realized by a physical device that does not use NFV technology, and the communication processing unit 433a may be implemented by one or more processors, memory (e.g., non-volatile memory and / or volatile memory), and / or a hard disk. The memory may be included in the one or more processors, or may be external to the one or more processors.

[0135] -Relationship with the first embodiment As an example, the communication processing unit 433a included in the MEC server 400a according to the second embodiment may perform the operation of the communication processing unit 433 included in the MEC server 400 according to the first embodiment. In the above case, the description of the first embodiment is also applicable to the second embodiment. Note that the second embodiment is not limited to the above example.

[0136] <<3.3. Configuration and Operation Example of External Server 500a>> 17 is a block diagram illustrating a schematic configuration of an external server 500a according to the second embodiment of the present invention. As shown in FIG. 17, the external server 500 is provided so as to be able to communicate with a core network 30a that forms multiple network slices.

[0137] The communication processing unit 533a of the external server 500a transmits a message including security information relating to the security of the terminal device to a core network node belonging to the core network 30a.

[0138] The external server 500a may be realized by a physical device such as a server device. The communication processing unit 533a may be implemented by one or more processors, memory (e.g., non-volatile memory and / or volatile memory), and / or a hard disk. The memory may be included in the one or more processors, or may be external to the one or more processors.

[0139] -Relationship with the first embodiment As an example, the communication processing unit 533a included in the external server 500a according to the second embodiment may execute the operation of the communication processing unit 533 included in the external server 500 according to the first embodiment. In the above case, the description of the first embodiment is also applicable to the second embodiment. Note that the second embodiment is not limited to the above example.

[0140] <<3.4.1. First Configuration and Operation Example of Communication System S1a>> 18 is a block diagram schematically illustrating a first configuration of a communication system S1a according to the second embodiment of the present invention. As shown in FIG. 18, the communication system S1a includes an access management node 350. a as core network nodes. The access management node 350a belongs to a core network 30a that forms multiple network slices.

[0141] The communication processing unit 333a of the access management node 350a transmits a command to the terminal device indicating parameters related to the network slice that should accommodate the terminal device, based on security information related to the security of the terminal device.

[0142] The access management node 350a and the communication processing unit 333a may be implemented by resources of the core network 30a virtualized using NFV technology. Alternatively, the access management node 350a may be realized by a physical device that does not use NFV technology, and the communication processing unit 333a may be implemented by one or more processors, memory (e.g., non-volatile memory and / or volatile memory) and / or a hard disk. The memory may be included in the one or more processors or may be external to the one or more processors.

[0143] -Relationship with the first embodiment As an example, the communication processing unit 333a included in the access management node 350a according to the second embodiment may execute the operation of the communication processing unit 333 included in the access management node 350 according to the first embodiment. In the above case, the description of the first embodiment is also applicable to the second embodiment. Note that the second embodiment is not limited to the above example.

[0144] <<3.4.2. Second Configuration and Operation Example of Communication System S1a>> 19 is a block diagram schematically illustrating a second configuration of a communication system S1a according to the second embodiment of the present invention. As shown in FIG. 19, the communication system S1a includes an access management node 350. a as core network nodes, and also includes an MEC server 400a. The access management node 350a and the MEC server 400 belong to a core network 30a that forms multiple network slices. Note that the MEC server 400a may be provided outside the core network 30a so as to be able to communicate with the core network 30a.

[0145] The communication processing unit 433a of the MEC server 400a transmits a message including security information relating to the security of the terminal device to the access management node 350. a (core network node).

[0146] The communication processing unit 333a of the access management node 350a transmits a command to the terminal device indicating parameters related to the network slice that should accommodate the terminal device, based on the security information from the MEC server 400a.

[0147] The access management node 350a and the communication processing unit 333a, as well as the MEC server 400a and the communication processing unit 433a, may be implemented by resources of the core network 30a that have been virtualized using NFV technology. Alternatively, the access management node 350a and / or the MEC server 400a may be realized by a physical device that does not use NFV technology, and the communication processing unit 333a and / or the communication processing unit 433a may be implemented by one or more processors, memory (e.g., non-volatile memory and / or volatile memory), and / or a hard disk. The memory may be included in the one or more processors, or may be external to the one or more processors.

[0148] -Relationship with the first embodiment As an example, the communication processing unit 333a included in the access management node 350a according to the second embodiment may perform the operation of the communication processing unit 333 included in the access management node 350 according to the first embodiment. Similarly, the communication processing unit 433a included in the MEC server 400a according to the second embodiment may perform the operation of the communication processing unit 433 included in the MEC server 400 according to the first embodiment. In the above cases, the description of the first embodiment is also applicable to the second embodiment. Note that the second embodiment is not limited to the above examples.

[0149] <<3.4.3. Third Configuration and Operation Example of Communication System S1a>> 20 is a block diagram illustrating a third configuration of a communication system S1a according to the second embodiment of the present invention. As shown in FIG. 20, the communication system S1a includes an access management node 350. a as core network nodes, and also includes an external server 500a. The access management node 350a belongs to a core network 30a that forms multiple network slices. The external server 500a is provided so as to be able to communicate with the core network 30a.

[0150] The communication processing unit 533a of the external server 500a sends a message including security information relating to the security of the terminal device to the access management node 350.a (core network node).

[0151] The communication processing unit 333a of the access management node 350a transmits a command indicating parameters related to the network slice that should accommodate the terminal device to the terminal device based on the security information from the external server 500a.

[0152] The access management node 350a and the communication processing unit 333a may be implemented by resources of the core network 30a virtualized using NFV technology. Alternatively, the access management node 350a may be realized by a physical device that does not use NFV technology, and the communication processing unit 333a may be implemented by one or more processors, memory (e.g., non-volatile memory and / or volatile memory) and / or a hard disk. The memory may be included in the one or more processors or may be external to the one or more processors.

[0153] The external server 500a may be realized by a physical device such as a server device. The communication processing unit 533a may be implemented by one or more processors, memory (e.g., non-volatile memory and / or volatile memory), and / or a hard disk. The memory may be included in the one or more processors, or may be external to the one or more processors.

[0154] -Relationship with the first embodiment As an example, the communication processing unit 333a included in the access management node 350a according to the second embodiment may perform the operation of the communication processing unit 333 included in the access management node 350 according to the first embodiment. Similarly, the communication processing unit 533a included in the external server 500a according to the second embodiment may perform the operation of the communication processing unit 433 included in the MEC server 400 according to the first embodiment. In the above cases, the description of the first embodiment is also applicable to the second embodiment. Note that the second embodiment is not limited to the above examples.

[0155] <<4. Other Embodiments>> Although the embodiments of the present invention have been described above, the present invention is not limited to these embodiments. It will be understood by those skilled in the art that these embodiments are merely examples and that various modifications are possible without departing from the scope and spirit of the present invention.

[0156] For example, the steps in the processes described herein do not necessarily have to be performed in chronological order according to the order depicted in the sequence diagrams. For example, the steps in the processes may be performed in an order different from that depicted in the sequence diagrams, or may be performed in parallel. Also, some of the steps in the processes may be deleted, and additional steps may be added to the processes.

[0157] In addition, a device (e.g., one or more devices (or units) of a plurality of devices (or units) constituting any of the above entities, or a module for one of the above plurality of devices (or units)) may be provided that includes components (e.g., a control unit, a detection unit, and / or a communication processing unit) of the terminal device, base station, core network node, MEC server, and external server described in this specification.

[0158] Also, a method including the processing of the above-described components may be provided, or a program for causing a processor to execute the processing of the above-described components may be provided. Also, a non-transitory computer-readable medium on which the program is recorded may be provided. Naturally, such devices, modules, methods, programs, and non-transitory computer-readable mediums are also included in the present invention.

[0159] A part or all of the above-described embodiments can be described as, but not limited to, the following supplementary notes.

[0160] (Appendix 1) A core network node belonging to a core network forming a plurality of network slices, a communication processing unit that transmits to the terminal device a command indicating parameters related to a network slice that should accommodate the terminal device based on security information related to security of the terminal device; Core network node.

[0161] (Appendix 2) The command includes slice information that identifies the network slice that should accommodate the terminal device. 2. A core network node as defined in Supplementary Note 1.

[0162] (Appendix 3) The command is a UE Configuration Update Command that updates the configuration of the terminal device. 2. A core network node according to claim 1.

[0163] (Appendix 4) The slice information includes an NSSAI (Network Slice Selection Assistance Information) parameter that identifies a slice / service type. 2. A core network node as defined in Supplementary Note 2.

[0164] (Appendix 5) The communication processing unit accommodates the terminal device in a quarantine network slice having a quarantine function based on the security information. 5. A core network node according to any one of Supplementary Note 1 to Supplementary Note 4.

[0165] (Appendix 6) The communication processing unit accommodates the terminal device in a network slice having a security level corresponding to the security information. 5. A core network node according to any one of Supplementary Note 1 to Supplementary Note 4.

[0166] (Appendix 7) the communication processing unit disconnects the target of attack indicated by the security information from the core network. 5. A core network node according to any one of Supplementary Note 1 to Supplementary Note 4.

[0167] (Appendix 8) a detection unit that detects vulnerabilities present in the terminal device and notifies the communication processing unit of the detected vulnerabilities as the security information; 8. A core network node according to any one of Supplementary Note 1 to Supplementary Note 7.

[0168] (Appendix 9) the detection unit detects the vulnerability based on a security capability of the terminal device indicated in a registration request message transmitted by the terminal device; 9. A core network node as defined in Supplementary Note 8.

[0169] (Appendix 10) The registration request message is transmitted from the terminal device at the time of location registration and includes an N2 parameter indicating the security capability. 10. A core network node as described in Supplementary Note 9.

[0170] (Appendix 11) The detection unit detects the vulnerability based on the content of communication on the C-plane of the terminal device. 11. A core network node according to any one of Supplementary Note 8 to Supplementary Note 10.

[0171] (Appendix 12) a detection unit that detects a threat to the terminal device and notifies the communication processing unit of the detected threat as the security information; 8. A core network node according to any one of Supplementary Note 1 to Supplementary Note 7.

[0172] (Appendix 13) the detection unit detects the threat based on the content of communication on the C-plane of the terminal device; 13. The core network node according to claim 12.

[0173] (Appendix 14) The communication processing unit receives, as the security information, vulnerabilities present in the terminal device or threats to the terminal device detected by a MEC (Mobile Edge Computing) server that belongs to the core network or can communicate with the core network. 8. A core network node according to any one of Supplementary Note 1 to Supplementary Note 7.

[0174] (Appendix 15) The security information indicates the vulnerability or the threat detected by the MEC server based on the communication content on the U-plane of the terminal device. 15. The core network node according to claim 14.

[0175] (Appendix 16) the communication processing unit receives, as the security information, a vulnerability present in the terminal device or a threat to the terminal device detected by an external server located outside the core network; 8. A core network node according to any one of Supplementary Note 1 to Supplementary Note 7.

[0176] (Appendix 17) the security information indicates the vulnerability or the threat detected by the external server based on the content of communication on the C-plane and / or U-plane of the terminal device; 17. The core network node according to claim 16.

[0177] (Appendix 18) 18. A core network node according to any one of Supplementary Note 1 to Supplementary Note 17, which is an Access and Mobility Management Function.

[0178] (Appendix 19) An MEC server that belongs to a core network that forms a plurality of network slices or can communicate with a core network that forms a plurality of network slices, a communication processing unit that transmits a message including security information related to security of a terminal device to a core network node that belongs to the core network; MEC server.

[0179] (Appendix 20) a detection unit that detects vulnerabilities present in the terminal device or threats to the terminal device and notifies the communication processing unit of the detected vulnerabilities or threats as the security information; 19. The MEC server according to claim 19.

[0180] (Appendix 21) An external server capable of communicating with a core network forming a plurality of network slices, a communication processing unit that transmits a message including security information related to security of a terminal device to a core network node that belongs to the core network; External server.

[0181] (Appendix 22) a detection unit that detects vulnerabilities present in the terminal device or threats to the terminal device and notifies the communication processing unit of the detected vulnerabilities or threats as the security information; 22. The external server according to claim 21.

[0182] (Appendix 23) A communication system comprising a core network node belonging to a core network forming a plurality of network slices, The core network node: a communication processing unit that transmits to the terminal device a command indicating parameters related to a network slice that should accommodate the terminal device based on security information related to security of the terminal device; Communication system.

[0183] (Appendix 24) a core network node belonging to a core network forming a plurality of network slices; A communication system comprising: an MEC server that belongs to the core network or can communicate with the core network, The MEC server a communication processing unit that transmits a message including security information related to security of a terminal device to the core network node; The core network node: A communication processing unit is provided that transmits to the terminal device a command indicating parameters related to a network slice that should accommodate the terminal device based on the security information from the MEC server. Communication system.

[0184] (Appendix 25) a core network node belonging to a core network forming a plurality of network slices; a communication system including an external server capable of communicating with the core network, The external server a communication processing unit that transmits a message including security information related to security of a terminal device to the core network node; The core network node: a communication processing unit that transmits to the terminal device a command indicating parameters related to a network slice that should accommodate the terminal device based on the security information from the external server; Communication system.

[0185] (Appendix 26) A method for controlling a core network node belonging to a core network that forms multiple network slices, comprising: transmitting a command to the terminal device indicating parameters related to a network slice that should accommodate the terminal device based on security information related to security of the terminal device; Control method.

[0186] (Appendix 27) A core network node belonging to a core network forming a plurality of network slices, and causing a computer to function as a core network node having a communication processing unit that transmits to a terminal device a command indicating parameters related to a network slice that should accommodate the terminal device, based on security information related to the security of the terminal device. program.

[0187] (Appendix 28) A core network node belonging to a core network forming a plurality of network slices, and causing a computer to function as a core network node having a communication processing unit that transmits to a terminal device a command indicating parameters related to a network slice that should accommodate the terminal device, based on security information related to the security of the terminal device. A non-transitory recording medium on which a program is recorded.

[0188] (Appendix 29) A core network node belonging to a core network forming a plurality of network slices, a detection unit that detects security threats based on signals transmitted and received by nodes managed by a specific operator; and a communication processing unit that controls the specific operator to be accommodated in another network slice based on the detected threat. Core network node.

[0189] (Appendix 30) A MEC (Mobile Edge Computing) server that belongs to a core network that forms multiple network slices or can communicate with a core network that forms multiple network slices, a detection unit that detects security threats based on signals transmitted and received by nodes managed by a specific operator; a communication processing unit that transmits a message including security information indicating the detected threat to a core network node that belongs to the core network; MEC server.

[0190] (Appendix 31) An external server capable of communicating with a core network forming a plurality of network slices, a detection unit that detects security threats based on signals transmitted and received by nodes managed by a specific operator; a communication processing unit that transmits a message including security information indicating the detected threat to a core network node that belongs to the core network; External server.

[0191] (Appendix 32) A communication system comprising a core network node belonging to a core network forming a plurality of network slices, The core network node: a communication processing unit that controls the specific operator to be accommodated in another network slice based on a security threat detected based on a signal transmitted and received by a node managed by the specific operator; Communication system.

[0192] (Appendix 33) A method for controlling a core network node belonging to a core network that forms multiple network slices, comprising: and controlling the specific operator to be accommodated in another network slice based on a security threat detected based on signals transmitted and received by nodes managed by the specific operator. Control method.

[0193] (Appendix 34) A core network node belonging to a core network forming a plurality of network slices, A computer is made to function as a core network node having a communication processing unit that controls a specific operator to be accommodated in another network slice based on a security threat detected based on signals transmitted and received by a node managed by the specific operator. program.

[0194] (Appendix 35) A core network node belonging to a core network forming a plurality of network slices, A computer is made to function as a core network node having a communication processing unit that controls a specific operator to be accommodated in another network slice based on a security threat detected based on signals transmitted and received by a node managed by the specific operator. A non-transitory recording medium on which a program is recorded.

[0195] This application claims priority based on Japanese Patent Application No. 2020-110059, filed on June 26, 2020, the disclosure of which is incorporated herein in its entirety. [Industrial Applicability]

[0196] Based on the security information SI (vulnerabilities or threats) detected by the access management node 350, the MEC server 400, or the external server 500, the terminal device 100 can be accommodated in an appropriate network slice. [Explanation of symbols]

[0197] S1 Communications System 30 Core Network 100 Terminal Device 200 base stations 300 core network nodes 350 Access Management Nodes 400 MEC Server 500 External Server

Claims

1. A core network node belonging to a core network forming a plurality of network slices, A communication processing means for transmitting to the terminal device a command indicating a parameter related to a network slice that should accommodate the terminal device based on security information related to security of the terminal device notified by the detection means, the detection means is means for detecting vulnerabilities or threats present in the terminal device based on the contents of communication on a C-plane or a U-plane, and notifying the communication processing means of the detected vulnerabilities or threats as the security information; the command is a command to update a configuration of the terminal device; Core network node.

2. The command includes slice information that identifies the network slice that should accommodate the terminal device. A core network node as claimed in claim 1.

3. The command is a UE Configuration Update Command that updates the configuration of the terminal device. A core network node according to claim 1 or 2.

4. The slice information includes a Network Slice Selection Assistance Information (NSSAI) parameter that identifies a slice / service type. A core network node as claimed in claim 2.

5. The communication processing means accommodates the terminal device in a quarantine network slice having a quarantine function based on the security information. A core network node according to any one of claims 1 to 4.

6. The communication processing means causes the terminal device to be accommodated in a network slice having a security level corresponding to the security information. A core network node according to any one of claims 1 to 4.

7. The communication processing means separates the target of the attack indicated by the security information from the core network. A core network node according to any one of claims 1 to 4.

8. The detection means detects the vulnerability based on a security capability of the terminal device indicated in a registration request message transmitted by the terminal device. A core network node as claimed in claim 1.

9. The registration request message is transmitted from the terminal device at the time of location registration and includes an N2 parameter indicating the security capability. A core network node according to claim 8.

10. The detection means is provided in an MEC server or an external server capable of communicating with the core network node. A core network node according to any one of claims 1 to 9.

Images