Zero trust anomaly traffic management for a network

Abstract

A computer-implemented method is provided for zero trust anomaly traffic management for a network. The method includes analyzing (1104) traffic data communicated from a NFC towards a NFP to obtain an identification of whether the traffic data includes a security anomaly. The method further includes performing (1108) one of (i) responsive to the identification including that a security anomaly is not identified in the traffic data, initiate keeping a routing policy for the NFP to handle the traffic data, and (ii) responsive to the identification including that a security anomaly is identified in the traffic data, initiate a first update of the routing policy to redirect the traffic data from the NFC to a dedicated network function producer, dNFP.

Description

ZERO TRUST ANOMALY TRAFFIC MANAGEMENT FOR A NETWORKTECHNICAL FIELD

[0001] The present disclosure relates generally to computer-implemented methods for zero trust anomaly traffic management for a network, and related methods and devices.BACKGROUND

[0002] As fifth generation (5G) networks migrate to public and hybrid cloud deployments, a 5G threat surface may expand. Cloud security may be a key consideration for communication service providers when deploying cloud-native 5G critical infrastructure in public and hybrid clouds, for example.

[0003] Cloud service providers and mobile network operators may share security responsibilities in a manner that requires the operators to take responsibility to secure their tenancy in the cloud. For example, the operator may need to perform proper due diligence of cloud service providers to ensure deployments are secure; and security responsibilities may be delegated as specified in a cloud agreement.SUMMARY

[0004] There currently exist certain challenges. Zero trust (ZT) security for networks, such as a telecommunication network, may be lacking. For example, the third generation partnership project (3GPP) releases 17 and 18 do not fully align with tenets of a zero trust architecture (ZTA). See e.g., Zero Trust Architecture, National Institute of Standards and Technology (NIST), NIST SP 800-207 (August 11, 2020). A transition from a 5G approach in 3GPP, for example, towards a ZT approach may be a major change for the telecommunications industry due at least to some proposed ZTAs being enterprise oriented. While security aspects are provided for networks, such as a 5G service based architecture (SBA), the service aspects may not fully comply with ZTA. For example, a security posture of a requesting entity may need to be constantly evaluated by dynamic access control policies. Further, mechanisms may be needed to enforce policies and actions that seek to maintain or even improve the security of a service. Such mechanisms and operations are not presently defined in 3GPP, for example.

[0005] Certain aspects of the disclosure and their embodiments may provide solutions to these or other challenges.

[0006] Some embodiments provide a computer-implemented method for zero trust anomaly traffic management for a network. The method includes analyzing traffic data communicated from a network function consumer, NFC, towards a network function provider, NFP, to obtain an identification of whether the traffic data includes a security anomaly. The method further includes performing one of (i) responsive to the identification including that a security anomaly is not identified in the traffic data, initiate keeping a routing policy for the NFP to handle the traffic data, and (ii) responsive to the identification including that a security anomaly is identified in the traffic data, initiate a first update of the routing policy to redirect the traffic data from the NFC to a dedicated network function producer, dNFP.

[0007] Other embodiments provide a computing device. The computing device is configured for zero trust anomaly traffic management for a network. The computing device includes processing circuitry; and memory coupled with the processing circuitry. The memory includes instructions that when executed by the processing circuitry causes the computing device to perform operations comprising to analyze traffic data communicated from a NFC towards a NFP to obtain an identification of whether the traffic data includes a security anomaly. The operations further include to perform one of (i) responsive to the identification including that a security anomaly is not identified in the traffic data, initiate keeping a routing policy for the NFP to handle the traffic data, and (ii) responsive to the identification including that a security anomaly is identified in the traffic data, initiate a first update of the routing policy to redirect the traffic data from the NFC to a dNFP.

[0008] Some embodiments provide a non-transitory computer readable medium including program code to be executed by processing circuitry of a computing device configured for zero trust anomaly traffic management for a network. Execution of the program code causes the program code to perform operations comprising to analyze traffic data communicated from a NFC towards a NFP to obtain an identification of whether the traffic data includes a security anomaly. The operations further include to perform one of (i) responsive to the identification including that a security anomaly is not identified in the traffic data, initiate keeping a routing policy for the NFP to handle the traffic data, and (ii) responsive to the identification including that a security anomaly is identified in the traffic data, initiate a first update of the routing policy to redirect the traffic data from the NFC to a dNFP.

[0009] Certain embodiments may provide one or more of the following technical advantage(s). Based on inclusion of operations for ZT anomaly traffic management, secure protection may be provided for network functions deployed in a network, such as a 5G core network for example. A network attack that occurs during a session may be captured and isolatedwithout NFP service interruption. Moreover, operations for ZT anomaly traffic management herein may: enforce a ZT paradigm since operations do not trust network entities present in the network (e.g., NFC and NFP); leverage a 3GPP network data analytics function (NWDAF) such that operations and related structure may be easily adopted by a standards group, e.g., 3GPP; permit keeping a service offering and maximizing availability and resilience, while promoting verification of the security of services and, thus, may ensure reliability; and / or provide security enhancement and protection in the process of migrating from the current non-ZT scenarios towards a ZTA. Further, operations for ZT anomaly traffic management may permit addressing use cases in 5GC operation, for example, that relates to enforcing ZT principles for its operation. It is noted, however, that embodiments herein and technical advantages are not limited to 5GC and include, without limitation, a radio access network (RAN) or a sixth generation (6G) network, for example. Moreover, based on some embodiments herein including a first machine learning (ML) model a fast scan may be enabled and a second ML model may be used for a deeper scan if traffic is flagged by the first ML model, which may reduce energy and computational overheads.BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The accompanying drawings, which are included to provide a further understanding of the disclosure and are incorporated in and constitute a part of this application, illustrate certain non-limiting embodiments of the present disclosure. In the drawings:

[0011] Figure 1 is a block diagram of an example of the logical components of a policy framework;

[0012] Figure 2A is a schematic drawing of an example of components to monitor traffic generated between a NFC and a NFP in accordance with some embodiments;

[0013] Figure 2B is a schematic drawing of an example of components to monitor traffic when a service communication proxy (SCP) is deployed in a path between a NFC and a NFP in accordance with some embodiments;

[0014] Figure 3 is a schematic drawing of an example of a deployment view in a 5G network in accordance with some embodiments;

[0015] Figure 4A is a schematic drawing of an example implementation in a 3GPP 5G core network in accordance with some embodiments;

[0016] Figure 4B is a schematic drawing of an example implementation in a 3GPP 5G core network including an SCP in accordance with some embodiments;

[0017] Figure 4C is a schematic drawing of an example implementation in a service management and orchestration (SMO) platform in an open radio access network, O-RAN, in accordance with some embodiments;

[0018] Figure 5 is a flow chart of an example of a logical flow in a ZT anomaly detection model (ZTADMF) in accordance with some embodiments;

[0019] Figure 6 is a flow chart of an example of a logical flow in a ZT network attack detection model (ZTNADMF) in accordance with some embodiments;

[0020] Figure 7 is a sequence diagram for an example for launching an NFP and dNFP in accordance with some embodiments;

[0021] Figure 8 is a sequence diagram for an example for anomaly traffic handling in an NFP in accordance with some embodiments;

[0022] Figure 9 is a sequence diagram for an example of anomaly traffic handling in a network repository function (NRF) in accordance with some embodiments;

[0023] Figure 10 is a sequence diagram for an example of normal and abnormal traffic handling in an NFP in accordance with some embodiments;

[0024] Figures 11-12 are flowcharts illustrating example operations of a computing device in accordance with some embodiments;

[0025] Figure 13 is a block diagram of a communication system in accordance with some embodiments;

[0026] Figure 14 is a block diagram of a user equipment (UE) in accordance with some embodiments;

[0027] Figure 15 is a block diagram of a network node in accordance with some embodiments;

[0028] Figure 16 is a block diagram of a computing device in accordance with some embodiments; and

[0029] Figure 17 is a block diagram of a virtualization environment in accordance with some embodiments.DETAILED DESCRIPTION

[0030] Some of the embodiments contemplated herein will now be described more fully with reference to the accompanying drawings. Embodiments are provided by way of example to convey the scope of the subject matter to those skilled in the art, in which examples of embodiments of the present disclosure are shown. Inventive concepts may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather,these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the present disclosure to those skilled in the art. It should also be noted that these embodiments are not mutually exclusive. Components from one embodiment may be tacitly assumed to be present / used in another embodiment.

[0031] The heterogeneous nature of a modern telecommunications infrastructure may make it increasingly difficult to protect network resources with conventional perimeter-oriented approaches to network security. By starting from an assumption that the attacker is already inside the network, a ZT model may enhance security by both blocking unauthorized access to network resources and preventing internal lateral movement by an attacker.

[0032] Due to many network functions (NF) in a 5G network, for example, monitoring NFs and logging their activity can pose a big challenge. To align to a ZT model, such mechanisms may need to be enhanced and ensured for networks, such as a 5G network, according to ZT tenets.

[0033] A primary aim of an approach to network security may be to protect the communication infrastructure so that it can provide services with the expected level of quality, free of disruption. By mitigating risks inside the network perimeter, a ZT model may make it easier for communication service providers (CSPs) to live up to their security commitments.

[0034] The NIST has described seven tenets for a ZTA, which include:1. All the data sources and computing service are considered resources.2. All communication is secured regardless of network location.3. Access to individual operator resources is granted on a per session basis.4. Access to resources is determined by dynamic policy.5. The operator monitors and measures the integrity and security posture of all owned and associated assets.6. All resources authentication and authorization are dynamic and strictly enforced before access is allowed.7. The operator collects as much information as possible about the current state of assets, network infrastructure and communications, and uses it to improve the security posture.

[0035] While 3GPP 5GS release 17 and 18 provides characteristics of a ZTA, 3GPP releases 17 and 18 may not fully align with such tenets of a ZTA. The transition from a current 5G security approach, for example, towards a ZT model may represent a major change for the telecommunications industry due to some ZT models being enterprise oriented, for example.

[0036] Four key security features in a network such as 5G may be of significance in terms of enabling ZTAs: secure digital identities, secure transport, policy frameworks, and security monitoring. Further, use cases for NWDAF can be extended for ZTA.

[0037] Figure 1 is a block diagram of an example of the logical components of a policy framework. Logical entities include the policy decision point (PDP) 104a and policy enforcement point (PEP) 102. To access a specific resource 106, a user can request (via a system 100 in an untrusted network) permission from the PDP 104a of a policy engine 104 to provide information needed to the PEP 102 in a trusted network to perform authentication and authorization.

[0038] Policy frameworks can be employed in 3GPP-based systems, for example, to manage access to resources in different security domains. For example, to gain access to 5G network services, a UE can contact an Access and Mobility Management Function (AMF) that takes a PEP role. A PDP role can be represented by multiple NFs where Unified Data Management (UDM) and the Policy Control Function (PCF) may be highlighted, among others.

[0039] Security monitoring also can be an important concept in 5G networks, for example. 3GPP establishes a framework for data collection and its analysis. Specifically, in one example, the NWDAF can leverage on a data collection scheme for a 5G core (5GC). Other examples include procedures for data analytics; and / or descriptions of interactions between a NWDAF and PCF, some analytics targets (e.g., abnormal behavior), and policy decisions based on results of those analytics. However, 3GPP documents do not presently address collection capabilities that help the decision making in a ZT model; or interaction with the policy framework to take advantage of the captured information and the results of the analysis.

[0040] In a 5G SBA, although security requirements are given, the security requirement may not fully comply with ZTA. The security posture of a requesting entity, for example, may be constantly evaluated by dynamic access control policies. Furthermore, in another example, a 5G system may need mechanisms to enforce policies and actions that seek to maintain or even improve the security of the service. Such mechanisms and operational work are not presently defined.

[0041] Thus, it may be desirable to to address the security of NFs within a network that can align with the ZT tenets and / or enhance authorization and management of anomalous traffic.

[0042] Certain aspects of the disclosure and their embodiments may provide solutions to these or other challenges.

[0043] Figure 2A is a schematic drawing of an example of components to monitor traffic generated between a NFC(s) 206a, 206b, 206c (any one of which can be referred to as NFC 206) and a NFP(s) 208a, 208b (any one of which can be referred to as NFP 208). The example in Figure 2A leverages a policy framework provided in 5G, for example, in which a PDP 104a and a PEP 102a, 102b are used.

[0044] Still referring to Figure 2A, traffic related data from NFPs 208a, 208b deployed in the network can be collected at data collection 202. The collected data can include, for example, access logs or data packet captured in NFPs 208a, 208b by monitoring utilities such as Wireshark. A first ML model comprising an anomaly traffic detection (ATD) model (shown as security anomaly detection 204 in Figure 2A) can be included in a monitoring and analytics component (M&A) 200; and security anomaly detection model 204 is applied to the collected traffic related data. The ATD model 204 can have a security focus, such as for a distributed denial-of-service (DDoS), Heartbleed, brute-force, infiltration, etc.; and can be a simple decision tree-based model or a convolutional neural network (CNN) based deep ML model, for example. If an anomaly traffic pattern is detected for a certain NFC(s) (NFC 206b in this example), a routing policy on an NFP(s) (NFP 208b in this example) can be updated to redirect the identified anomalous traffic to a dNFP 208c, which can be monitored by a second ML model comprising a network attack detection model (NADM) such as NADM 210. Normal (e.g., safe traffic) can be handled by conventional NFPs 208a, 208b.

[0045] Figure 2B is a schematic drawing of an example of components to monitor traffic when a SCP 212 is deployed in the path between a NFC (NFCs 206a, 206b, 206c in this example) and a NFP (NFPs 208a, 208b in this example).

[0046] Components 200-210 and 104a are described above with respect to Figure 2A and, for brevity, the description is not repeated for those components in Figure 2B. In the example in Figure 2B, as shown, the SCP 212 is the place for policy enforcement, PEP, 102a.

[0047] Figure 3 is a schematic drawing of an example of a deployment view 300 in a 5G network. Two ML based models are deployed in an edge cloud at location A and B : ADM 302 and NADM 308. Operations of examples herein use a policy framework similar to what has been defined in 3GPP, for example.

[0048] Still referring to Figure 3, as a deployment example, in order to meet the demand for the service provided by a NFP 208, six NFP instances 208a, 208b, 208c, 208d, 208e, 208f are deployed in the network, and one extra NFP is deployed as the dNFP 306 to handle anomaly traffic detected by ADM 302. It is noted that a dNFP 306 is created for each NFP type. The dNFP(s) 306 provide the same service as NFP 208. In this way, traffic from suspicious NFCs 308 can be investigated without service interruption.

[0049] The dNFP 306 in the example of Figure 3 is monitored and analyzed. NADM 308 can be used to sort out different network attacks from the anomaly traffic. NADM 308 also can try to rule out traffic that is mistakenly detected as abnormal traffic by the ADM 302. The outcome of the investigation of the NADM 308 can be used to update the routing policy in PCF (e.g., PDP104a) for the NFP 208 and NRF. The traffic from a suspicious NFC 308 can be handled as normal traffic if a misclassification is detected by the NADM 308 thus, the corresponding traffic will be put back to a normal NFP 208c, 208f instead, as shown by the lines from NFC 308 to NFP 208c and NFP 208f, respectively.

[0050] Figure 4A is a schematic drawing of an example implementation in a 3GPP 5G core 400 network. This example leverages a data analytic service and framework provided by a 3GPP 5G core network, with three new function components included: a first ML model, ZT anomaly detection model (ZTADMF); a second ML model ZT network attack detection model function (ZTNADMF) 404; and a Central Management Service (CMS) 410 for an anomalous traffic monitoring system (ATMS), as discussed further herein.

[0051] Referring to Figure 4A, ZTADMF 402 can be designed to collect the traffic data from NFP 208, detect abnormal traffic from monitored NFP 208, and adjust the routing policy on the NFP 208 or the access policy on a NRF 408 to redirect abnormal traffic to a dedicated NFP, dNFP 306.

[0052] ZTNADMF 404 can be designed to monitor the traffic on the dNFP 306 by collecting the traffic data from NFC 206 and adjusting the routing policy on the NFP 208 or the access policy on the NRF 408 to put misclassification traffic back to the NFP 208. For those identified network attacks, an alarm can be raised through CMS 410 for an ATMS.

[0053] The CMS 410 can be designed to coordinate the above two components, that is, ZTADMF 402 and ZTNADMF 404 via a configuration or monitoring service 410.

[0054] Still referring to Figure 4A, a policy decision point (PDP) can be the place to make a routing decision for the traffic. The implementation can be done by extending an existing PCF functionalities, adding a PDP into NRF 408 as indicated in Figure 4A, or by introducing a new network function dedicated for this PDP, for example.

[0055] A policy enforcement point (PEP) can be the place to enforce the routing decision for anomaly traffic routing. The implementation can be done either at an NFP 208 or SCP 212, for example, if it is deployed in front of NFP(s) 208 as indicated in Figure 4B.

[0056] In the example as shown in Figure 4B in which an SCP 212 is deployed in front of NFP(s) 208, a PEP is put in the SCP 212, instead of in NFP 208, to enforce the policy given by PCF 406a.

[0057] Figure 4C is a schematic drawing of an example implementation in a SMO platform 500 in O-RAN.

[0058] In some embodiments, a computer-implemented method is provided for ZT anomaly traffic management for a network. The method includes analyzing (operation 1104 in Figure 11)traffic data communicated from a NFC towards a NFP to obtain an identification of whether the traffic data includes a security anomaly. The method further includes performing (operation 1108 in Figure 11) one of (i) responsive to the identification including that a security anomaly is not identified in the traffic data, initiate keeping a routing policy for the NFP to handle the traffic data, and (ii) responsive to the identification including that a security anomaly is identified in the traffic data, initiate a first update of the routing policy to redirect the traffic data from the NFC to a dNFP.

[0059] In some embodiments, analyzing (1104) and performing (1108) is performed by at least one of a first statistical based model and a first ML model.

[0060] The method can further include collecting (operation 1102 in Figure 11) the traffic data from the NFP.

[0061] In some embodiments, the method further includes identifying (operation 1106 in Figure 11) the NFC or a UE associated with the security anomaly.

[0062] Further, in some embodiments, the method further includes, responsive to the first update of the routing policy, analyzing (operation 1110 in Figure 11) the dNFP to obtain a verification of whether the security anomaly includes an anomalous traffic pattern or a non- anomalous traffic pattern. The method further includes performing (operation 1112 in Figure 11) one of (i) responsive to verification that the security anomaly includes an anomalous traffic pattern, initiate a second update of the routing policy for the NFP to accept the traffic data, and (ii) responsive to verification that the security anomaly includes a non-anomalous traffic pattern, initiate an adjustment to the routing policy to route the traffic data back onto the NFP.

[0063] Some embodiments further include initiating (operation 1114 in Figure 11) an alarm responsive to the verification that the security anomaly includes an anomalous traffic pattern.

[0064] Analyzing (1110) and (1112) can be performed by at least one of a second statistical model and a second ML model.

[0065] In some embodiments, the method further includes collecting (operation 1200 in Figure 12) the security anomaly from the dNFP.

[0066] Analyzing (1110) the dNFP can include a detection of whether an attack occurred on the network from the security anomaly in a specified time period.

[0067] In some embodiments, (i) from operation 1112 further includes to identify the NFC from which the security anomaly originates, and (ii) from operation 1112 further includes to initiate an adjustment to the routing policy to route the traffic data back onto the NFP that includes to initiate the second update to accept the traffic data.

[0068] In some embodiments, the method further includes to clear (operation 1202 in Figure 12) the alarm.

[0069] Collecting (1200) the traffic data from the NFP can include collecting the traffic data from at least one of an access log, a data packet, and a key performance indicator (KPI).

[0070] Traffic data communicated from a NFC towards a NFP can include a SCP between the NFC and the NFP. Additionally, traffic data can be communicated from the NFC to the SCP and from the SCP to the NFP.

[0071] In some embodiments, the method further includes launching (1100) an instance of the NFP to provide zero trust anomaly traffic management for a network.

[0072] The network can include at least one of a telecommunications network and an O-RAN.

[0073] Figure 5 is a flowchart of an example of a logical flow in a ZTADMF. In this example, a process starts 500, and a ZTADMF (e.g., ZTADMF 402, 506a) collects 502 data from a NFP using a data pipeline framework provided in a 5G core network. The ZTADMF processes 504 the data, e.g., access log, data packet, or a KPI, etc.; and converts the data into a format needed by an ADM. ZTADMF further applies the ADM to detect 506 if abnormal traffic is detected within a defined time interval (e.g., time period).

[0074] If abnormal traffic is identified 508, such as abnormal traffic in terms of a network attack (such as DDoS, brute- force, etc.), the ZTADMF locates 510 from which NFC(s) the suspicious traffic comes and discovers 512 a dNFP for handling the abnormal traffic. The ZTADMF also sends 514 a request to a PCF to update the routing policy for the NFP(s) to redirect the traffic from the suspicious NFC(s) to the identified dNFP(s). Further, an alarm is raised 516 regarding this anomaly detection.

[0075] If suspicious traffic is not identified 508, no action is taken 518 (that is, a current routing policy is kept).

[0076] Figure 6 is a flow chart of an example of a logical flow in a ZTNADMF (e.g., ZTNADMF 404, 506b). In this example, a process starts 600, and the ZTNADMF collects 602 data from a dNFP using a data pipeline framework provided in a 5G core network. The ZTNADMF processes 604 the data, e.g., access log, data packet, or KPI, etc.; and converts the data into a format needed by the NADM. The ZTNADMF applies the NADM to detect 606 if a network attack is detected from the suspicious traffic within a defined time interval (e.g., a time period).

[0077] If network attack traffic is identified 608, the ZTNADMF locates from which NFC(s) the network attack traffic originates. The ZTNADMF also sends 616 the request to a PCF to update the policy for the dNFP(s) and NRF to block the traffic from the suspicious NFC(s). Additionally, an alarm is raised 618 regarding the network attack.

[0078] If normal traffic is detected 608 within the identified suspicious traffic, the ZTNADMF discovers 610 NFP(s) via the NRF, and sends 612 the request to the PCF to update the routing policy of NFP(s) to accept the traffic from the identified NFC(s) instead of re-directing them. Further, the corresponding alarm is cleared 614.

[0079] The process continues at operation 620.

[0080] Figure 7 is a sequence diagram for an example for launching an NFP 208 and dNFP306. It is noted that the ZTADMF 402 and ZTNADMF 404 in the example in Figure 7 are two pre-trained ML models deployed in an operator network.

[0081] Referring to the example in Figure 7, the following operations are taken to launch an NFP instance to provide a corresponding service. A pre-condition in this example is that both the ZTADMF and ZTNADMF are registered in a NRF:1. A CMS 410 configures a PDP via PCF 406a to create / update / delete the routing policy for an NFP 208 and the access policy for a dNFP 306.2. The PDP 406a accepts the request to create / update / delete the policies for the NFP 208 and dNFP 306.3. The CMS 410 launches NFP instance(s) 208 based on a service demand volume.4. The NFP instance 208 fetches the routing policy from the PDP 406a.5. The PDP 406a answers with the policy.6. The NFP 208 registers its service into the NRF 408.7. The NRF 408 responds to the NFP’s 208 request successfully.8. The NFP instance 208 sends the success response back to the CMS 410.9. The CMS 410 sends the request to the NRF 208 to discover a ZTADMF instance 402 that has an anomaly traffic detection capability for the service to be offered by NFP 208.10. The NRF 408 returns the qualified ZTAMDF instance 402.11. The CMS 410 sends a list of NFPs to be launched to the selected ZTADMF instance 402.12. The ZTADMF 402 sends the request to a 5GC data pipeline 500 to prepare the data collection for the ZTADMF 402.13. The ZTADMF 402 subscribes to the data service offered by the NFP instance 208.14. The NFP instance 208 notifies the 5GC data pipeline 500.15. The 5GC data pipeline 500 notifies the ZTAMDF 402.16. The ZTADMF 402 sends a success / ACK to the 5GC data pipeline 500.17. The ZTADMF 402 sends the success / ACK to the CMS 410.18. The CMS 410 launches one dNFP 306 after the first NFP instance 208 is created. That is, one dNFP 306 is launched per NFP type.19. The dNFP 306 instance fetches the routing policy from the PDP 406a.20. The PDP 406a answers with the policy.21. The dNFP 306 registers its service into the NRF 408.22. The NRF 408 responds to the dNFP’s 306 request successfully.23. The dNFP instance 306 sends the success response back to the CMS 410.24. The CMS 410 sends the request to the NRF 408 to discover the ZTNADMF 404 to investigate the traffic in the dNFP 306.25. The NRF 408 returns the qualified ZTNAMDF 404 to the CMS 410.26. The CMS 410 sends a list of NFPs to be launched to the selected ZTADMF instance 404.27. The ZTNADMF 404 sends the request to the 5GC data pipeline 500 to prepare the data collection for the ZTNADMF 404.28. The ZTNADMF 404 subscribes to the data service offered by the dNFP instance 306.29. The NFP instance 208 notifies the 5GC data pipeline 500.30. The 5GC data pipeline 500 notifies the ZTNAMDF 404.31. The ZTNADMF 404 sends a success / ACK to the 5GC data pipeline 500.32. The ZTNADMF 404 sends the success / ACK to the CMS 410.

[0082] Figure 8 is a sequence diagram for an example for anomaly traffic handling in an NFP 208. In this example, the following operations are performed to manage abnormal traffic in an NFP 208 detected by a ZTADMF 402:1. A ZTADMF 402 detects abnormal traffic patterns from data collected from an NFP(s). The ZTADMF 402 also identifies one or more NFCs that are associated with this abnormal traffic pattern.2. The ZTADMF 402 discovers a dNFP 306 that is allocated for the NFP(s) from which the data is collected.3. The NRF 408 returns the dNFP 306 to the ZTADMF 402.4. The ZTADMF 402 updates the routing policy for the NFP(s) in a PDP 406a to redirect the traffic from the suspicious NFC(s) 308 to the dNFP 306.5. The PDP 406a sends confirmation back to the ZTADMF 402.6. The PDP 406a sends a notification to the corresponding NFP 208 about the routing policy update.7. The NFP 208 sends a confirmation back to the PDP 406a.8. The NFP 208 loads the updated routing policy.9. The ZTADMF 402 updates the access policy for the dNFP 306 in the PDP 406a to allow the requests from the suspicious NFC(s) 308.10. The PDP 406a sends a confirmation back to the ZTADMF 402.11. At the same time, the PDP 406a also sends a notification to dNFP 306.12. The dNFP 306 sends a confirmation back to PDP 406a.13. The NFC (suspicious) 308 sends a request to NFP 208.14. The NFP 208 applies the new routing policy and decides to redirect the request to the dNFP 306.15. The NFP 208 sends a 301 redirect response back to the NFC 308.16. The dNFP 306 loads the updated access policy.17. The NFC (suspicious) 308 follows the redirect instruction to dNFP 306.18. The dNFP 306 applies the new access policy.19. The dNFP 306 sends a response back to NFC 308.

[0083] Figure 9 is a sequence diagram for an example of anomaly traffic handling in a NRF 408. In this example, the following operations are performed to manage abnormal traffic in a NRF 408 detected by a ZTADMF 402:1. The ZTADMF 402 detects abnormal traffic patterns from the data collected from a NFP(s). The ZTADMF 402 also identifies one or more NFCs 308 that are associated with the abnormal traffic pattern.2. The ZTADMF 402 discovers a dNFP(s) 306 that is allocated for the NFP(s) from which the data is collected.3. A NRF 408 returns an address of the dNFP(s) 306.4. The ZTADMF 402 updates the routing policy in the NRF 408 to handle the suspicious NFC(s) 308.5. A PDP 406a sends a confirmation to the ZTADMF 402.6. The PDP 406a notifies the NRF408 about the update of the routing policy.7. The NRF 408 sends a confirmation back to the PDP 406a.8. The NRF 408 uploads the updated routing policy.9. The ZTADMF 402 updates the access policy in the dNFP(s) 306 to allow the traffic from the suspicious NFC(s) 308.10. The PDP 406a sends a confirmation back to the ZTADMF 402.11. The PDP 406a notifies the dNFP(s) 306 about the change of the access policy.12. The dNFP(s) 306 confirms that it received the access policy successfully.13. The suspicious NFC(s) 308 sends a request to the NRF 408.14. The NRF 408 applies the new routing policy and picks the dNFP(s) 306 instead of the NFP 208.15. The NRF 408 returns the dNFP(s) 306 to the suspicious NFC(s) 308.16. The suspicious NFC(s) 308 sends a request to the dNFP(s) 306.17. The dNFP(s) 306 applies the new access policy to the request from the suspicious NFC(s) 308.18. The dNFP(s) 306 sends a response back to the suspicious NFC(s) 308.

[0084] Figure 10 is a sequence diagram for an example of normal and abnormal traffic handling in an NFP 208. In this example, the following operations are performed to manage traffic that is considered as normal according to a ZTNADMF 404 from suspicious NFC(s) 308 previously detected by a ZTADMF 402:1. A ZTNADMF 404 detects that traffic from a suspicious NFC(s) 308 is to be considered as normal. That traffic is to be handled by an NFP instead of a dNFP 306. The ZTNADMF 404 discovers the NFP(s) that offers a service to those NFC(s).2. A NRF 408 returns an address of those NFP(s).3. The ZTNADMF 404 updates the routing policy for those NFP(s) to accept the service request sent by those NFC(s).4. A PDP 406a sends a confirmation back to the ZTNADMF 404.5. The PDP 406a notifies those NFP(s) about the update of the routing policy.6. The NRF 408 sends a confirmation back to the PDP 406a.7. The NRF 408 uploads the routing policy.8. The NFC(s) 206 which is considered as normal by the ZTNADMF 404 sends a request to the NRF 408.9. The NRF 408 applies the new routing policy and handles the request instead of redirecting the request to the dNFP(s) 306.10. The NRF 408 provides a service response back to the NFC(s) 206. It is noted that, at this point, other suspicious NFC(s) 308 under investigation still send a request to the dNFP(s) 306.11. The NFC 206 sends a request to the NFP(s) 208.12. The NFP(s) 208 sends a response back to the NFC(s) 206.

[0085] As previously discussed, functions and / or components discussed herein can be implemented as rApps in a SMO. As standard interfaces are evolving for 0-RAN to provide analytics information to the 5GC, such an implementation may allow application of operations of embodiments discussed herein to detect 0-RAN anomalies from the 5GC and provide security policy updates back to a RAN via the SMO. Such a service may help an 0-RAN to realize a ZTA.

[0086] Some embodiments discussed herein may have a significant impact on the development of security measurement in 3GPP in order to move towards ZTA.

[0087] The terms “anomalous traffic”, “anomaly traffic”, and / or “security anomaly” refer to traffic data that includes an aberration, fault, deviation, abnormality, error, deficiency, undesirable data, etc. For example, a security anomaly may be a rare event in a given time horizon. As such, the event may be various things including, without limitation, lower than expected traffic, higher than expected traffic, traffic from unexpected sources, and / or traffic to unexpected destinations (e.g., receivers), for example.

[0088] Operations of a computing device can be performed by the computing device 6400 of Figure 16. Operations of the computing device have been discussed with reference to the flow charts of Figures 11 and 12 according to some embodiments of the present disclosure. For example, modules may be stored in memory 6404 or in ZT anomaly traffic management component 6418 of Figure 16, and these modules may provide instructions so that when the instructions of a module are executed by respective computing device processing circuitry 6402, computing device 6400 performs respective operations of the flow charts.

[0089] Various operations from the flow charts of Figures 11 and 12 may be optional with respect to some embodiments of computing devices and related methods. For example the operations of blocks 1100, 1102, 1106, 1110, 1112, 1114, 1200, and 1202 may be optional.

[0090] Figure 13 shows an example of a communication system 1300 in accordance with some embodiments.

[0091] In the example, the communication system 1300 (also referred to herein as a network) includes a telecommunication network 1302 that includes an access network 1304, such as a RAN, and a core network 1306, which includes one or more core network nodes 1308. The access network 1304 includes one or more access network nodes, such as network nodes 1310a and 1310b (one or more of which may be generally referred to as network nodes 1310), or any other similar 3GPP access node or non-3GPP access point. The network nodes 1310 facilitate direct or indirect connection of UE, such as by connecting UEs 1312a, 1312b, 1312c, and 1312d (one or more of which may be generally referred to as UEs 1312) to the core network 1306 over one or more wireless connections. A computing device (e.g., computing device 6400) can be a core network node 1308 or another node comprising a computing device in communication system 1300 (including with respect to a NWDAF or in an O-RAN, as discussed further herein).

[0092] Example wireless communications over a wireless connection include transmitting and / or receiving wireless signals using electromagnetic waves, radio waves, infrared waves, and / or other types of signals suitable for conveying information without the use of wires, cables,or other material conductors. Moreover, in different embodiments, the communication system 1300 may include any number of wired or wireless networks, computing devices, network nodes, UEs, and / or any other components or systems that may facilitate or participate in the communication of data and / or signals whether via wired or wireless connections. The communication system 1300 may include and / or interface with any type of communication, telecommunication, data, cellular, radio network, and / or other similar type of system.

[0093] The UEs 1312 may be any of a wide variety of communication devices, including wireless devices arranged, configured, and / or operable to communicate wirelessly with the network nodes 1310 and other communication devices. Similarly, the network nodes 1310 are arranged, capable, configured, and / or operable to communicate directly or indirectly with the UEs 1312 and / or with other network nodes or equipment in the telecommunication network 1302 to enable and / or provide network access, such as wireless network access, and / or to perform other functions, such as administration in the telecommunication network 1302.

[0094] In the depicted example, the core network 1306 connects the network nodes 1310 to one or more hosts, such as host 1316. These connections may be direct or indirect via one or more intermediary networks or devices. In other examples, network nodes may be directly coupled to hosts. The core network 1306 includes one more core network nodes (e.g., core network node 1308) that are structured with hardware and software components. Features of these components may be substantially similar to those described with respect to the UEs, network nodes, and / or hosts, such that the descriptions thereof are generally applicable to the corresponding components of the core network node 1308. Example core network nodes include functions of one or more of a Mobile Switching Center (MSC), Mobility Management Entity (MME), Home Subscriber Server (HSS), Access and Mobility Management Function (AMF), Session Management Function (SMF), Authentication Server Function (AUSF), Subscription Identifier De-concealing function (SIDE), Unified Data Management (UDM), Security Edge Protection Proxy (SEPP), Network Exposure Function (NEF), and / or a User Plane Function (UPF).

[0095] The host 1316 may be under the ownership or control of a service provider other than an operator or provider of the access network 1304 and / or the telecommunication network 1302, and may be operated by the service provider or on behalf of the service provider. The host 1316 may host a variety of applications to provide one or more service. Examples of such applications include live and pre-recorded audio / video content, data collection services such as retrieving and compiling data on various ambient conditions detected by a plurality of UEs, analytics functionality, social media, functions for controlling or otherwise interacting with remote devices, functions for an alarm and surveillance center, or any other such function performed by a server.

[0096] As a whole, the communication system 1300 of Figure 13 enables connectivity between the UEs, network nodes, and hosts. In that sense, the communication system may be configured to operate according to predefined rules or procedures, such as specific standards that include, but are not limited to: Global System for Mobile Communications (GSM); Universal Mobile Telecommunications System (UMTS); Long Term Evolution (LTE), and / or other suitable 2G, 3G, 4G, 5G standards, or any applicable future generation standard (e.g., 6G); wireless local area network (WLAN) standards, such as the Institute of Electrical and Electronics Engineers (IEEE) 802.11 standards (WiFi); and / or any other appropriate wireless communication standard, such as the Worldwide Interoperability for Microwave Access (WiMax), Bluetooth, Z-Wave, Near Field Communication (NFC) ZigBee, LiFi, and / or any low-power wide-area network (LPWAN) standards such as LoRa and Sigfox.

[0097] In some examples, the telecommunication network 1302 is a cellular network that implements 3GPP standardized features. Accordingly, the telecommunications network 1302 may support network slicing to provide different logical networks to different devices that are connected to the telecommunication network 1302. For example, the telecommunications network 1302 may provide ultra-reliable low latency communication (URLLC) services to some UEs, while providing eMBB services to other UEs, and / or mMTC / Massive loT services to yet further UEs.

[0098] In some examples, the UEs 1312 are configured to transmit and / or receive information without direct human interaction. For instance, a UE may be designed to transmit information to the access network 1304 on a predetermined schedule, when triggered by an internal or external event, or in response to requests from the access network 1304. Additionally, a UE may be configured for operating in single- or multi-RAT or multi-standard mode. For example, a UE may operate with any one or combination of Wi-Fi, NR and LTE, i.e. being configured for multi-radio dual connectivity (MR-DC), such as E-UTRAN (Evolved-UMTS Terrestrial Radio Access Network) New Radio - Dual Connectivity (EN-DC).

[0099] In the example, the hub 1314 communicates with the access network 1304 to facilitate indirect communication between one or more UEs (e.g., UE 1312c and / or 1312d) and network nodes (e.g., network node 1310b). In some examples, the hub 1314 may be a controller, router, content source and analytics, or any of the other communication devices described herein regarding UEs. For example, the hub 1314 may be a broadband router enabling access to the core network 1306 for the UEs. As another example, the hub 1314 may be a controller that sends commands or instructions to one or more actuators in the UEs. Commands or instructions may be received from the UEs, network nodes 1310, or by executable code, script, process, or otherinstructions in the hub 1314. As another example, the hub 1314 may be a data collector that acts as temporary storage for UE data and, in some embodiments, may perform analysis or other processing of the data. As another example, the hub 1314 may be a content source. For example, for a UE that is a VR headset, display, loudspeaker or other media delivery device, the hub 1314 may retrieve VR assets, video, audio, or other media or data related to sensory information via a network node, which the hub 1314 then provides to the UE either directly, after performing local processing, and / or after adding additional local content. In still another example, the hub 1314 acts as a proxy server or orchestrator for the UEs, in particular if one or more of the UEs are low energy loT devices.

[0100] The hub 1314 may have a constant / persistent or intermittent connection to the network node 1310b. The hub 1314 may also allow for a different communication scheme and / or schedule between the hub 1314 and UEs (e.g., UE 1312c and / or 1312d), and between the hub 1314 and the core network 1306. In other examples, the hub 1314 is connected to the core network 1306 and / or one or more UEs via a wired connection. Moreover, the hub 1314 may be configured to connect to an M2M service provider over the access network 1304 and / or to another UE over a direct connection. In some scenarios, UEs may establish a wireless connection with the network nodes 1310 while still connected via the hub 1314 via a wired or wireless connection. In some embodiments, the hub 1314 may be a dedicated hub - that is, a hub whose primary function is to route communications to / from the UEs from / to the network node 1310b. In other embodiments, the hub 1314 may be a non-dedicated hub - that is, a device which is capable of operating to route communications between the UEs and network node 1310b, but which is additionally capable of operating as a communication start and / or end point for certain data channels.

[0101] Figure 14 shows a UE 4200 in accordance with some embodiments. As used herein, a UE refers to a device capable, configured, arranged and / or operable to communicate wirelessly with network nodes and / or other UEs. Examples of a UE include, but are not limited to, a smart phone, mobile phone, cell phone, voice over IP (VoIP) phone, wireless local loop phone, desktop computer, personal digital assistant (PDA), wireless cameras, gaming console or device, music storage device, playback appliance, wearable terminal device, wireless endpoint, mobile station, tablet, laptop, laptop-embedded equipment (LEE), laptop-mounted equipment (LME), smart device, wireless customer-premise equipment (CPE), vehicle, vehicle-mounted or vehicle embedded / integrated wireless device, etc. Other examples include any UE identified by the 3rd Generation Partnership Project (3GPP), including a narrow band internet of things (NB-IoT) UE, a machine type communication (MTC) UE, and / or an enhanced MTC (eMTC) UE.

[0102] A UE may support device-to-device (D2D) communication, for example by implementing a 3GPP standard for sidelink communication, Dedicated Short-Range Communication (DSRC), vehicle-to-vehicle (V2V), vehicle-to-infrastructure (V2I), or vehicle-to- everything (V2X). In other examples, a UE may not necessarily have a user in the sense of a human user who owns and / or operates the relevant device. Instead, a UE may represent a device that is intended for sale to, or operation by, a human user but which may not, or which may not initially, be associated with a specific human user (e.g., a smart sprinkler controller). Alternatively, a UE may represent a device that is not intended for sale to, or operation by, an end user but which may be associated with or operated for the benefit of a user (e.g., a smart power meter).

[0103] The UE 4200 includes processing circuitry 4202 that is operatively coupled via a bus 4204 to an input / output interface 4206, a power source 4208, a memory 4210, a communication interface 4212, and / or any other component, or any combination thereof. Certain UEs may utilize all or a subset of the components shown in Figure 14. The level of integration between the components may vary from one UE to another UE. Further, certain UEs may contain multiple instances of a component, such as multiple processors, memories, transceivers, transmitters, receivers, etc.

[0104] The processing circuitry 4202 is configured to process instructions and data and may be configured to implement any sequential state machine operative to execute instructions stored as machine-readable computer programs in the memory 4210. The processing circuitry 4202 may be implemented as one or more hardware-implemented state machines (e.g., in discrete logic, field-programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), etc.); programmable logic together with appropriate firmware; one or more stored computer programs, general-purpose processors, such as a microprocessor or digital signal processor (DSP), together with appropriate software; or any combination of the above. For example, the processing circuitry 4202 may include multiple central processing units (CPUs).

[0105] In the example, the input / output interface 4206 may be configured to provide an interface or interfaces to an input device, output device, or one or more input and / or output devices. Examples of an output device include a speaker, a sound card, a video card, a display, a monitor, a printer, an actuator, an emitter, a smartcard, another output device, or any combination thereof. An input device may allow a user to capture information into the UE 4200. Examples of an input device include a touch-sensitive or presence-sensitive display, a camera (e.g., a digital camera, a digital video camera, a web camera, etc.), a microphone, a sensor, a mouse, a trackball, a directional pad, a trackpad, a scroll wheel, a smartcard, and the like. The presence-sensitivedisplay may include a capacitive or resistive touch sensor to sense input from a user. A sensor may be, for instance, an accelerometer, a gyroscope, a tilt sensor, a force sensor, a magnetometer, an optical sensor, a proximity sensor, a biometric sensor, etc., or any combination thereof. An output device may use the same type of interface port as an input device. For example, a Universal Serial Bus (USB) port may be used to provide an input device and an output device.

[0106] In some embodiments, the power source 4208 is structured as a battery or battery pack. Other types of power sources, such as an external power source (e.g., an electricity outlet), photovoltaic device, or power cell, may be used. The power source 4208 may further include power circuitry for delivering power from the power source 4208 itself, and / or an external power source, to the various parts of the UE 4200 via input circuitry or an interface such as an electrical power cable. Delivering power may be, for example, for charging of the power source 4208. Power circuitry may perform any formatting, converting, or other modification to the power from the power source 4208 to make the power suitable for the respective components of the UE 4200 to which power is supplied.

[0107] The memory 4210 may be or be configured to include memory such as random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic disks, optical disks, hard disks, removable cartridges, flash drives, and so forth. In one example, the memory 4210 includes one or more application programs 4214, such as an operating system, web browser application, a widget, gadget engine, or other application, and corresponding data 4216. The memory 4210 may store, for use by the UE 4200, any of a variety of various operating systems or combinations of operating systems.

[0108] The memory 4210 may be configured to include a number of physical drive units, such as redundant array of independent disks (RAID), flash memory, USB flash drive, external hard disk drive, thumb drive, pen drive, key drive, high-density digital versatile disc (HD-DVD) optical disc drive, internal hard disk drive, Blu-Ray optical disc drive, holographic digital data storage (HDDS) optical disc drive, external mini-dual in-line memory module (DIMM), synchronous dynamic random access memory (SDRAM), external micro-DIMM SDRAM, smartcard memory such as tamper resistant module in the form of a universal integrated circuit card (UICC) including one or more subscriber identity modules (SIMs), such as a USIM and / or ISIM, other memory, or any combination thereof. The UICC may for example be an embedded UICC (eUICC), integrated UICC (iUICC) or a removable UICC commonly known as ‘SIM card.’ The memory 4210 may allow the UE 4200 to access instructions, application programs and the like, stored on transitory or non-transitory memory media, to off-load data, or to upload data. Anarticle of manufacture, such as one utilizing a communication system may be tangibly embodied as or in the memory 4210, which may be or comprise a device-readable storage medium.

[0109] The processing circuitry 4202 may be configured to communicate with an access network or other network using the communication interface 4212. The communication interface 4212 may comprise one or more communication subsystems and may include or be communicatively coupled to an antenna 4222. The communication interface 4212 may include one or more transceivers used to communicate, such as by communicating with one or more remote transceivers of another device capable of wireless communication (e.g., another UE or a network node in an access network). Each transceiver may include a transmitter 4218 and / or a receiver 4220 appropriate to provide network communications (e.g., optical, electrical, frequency allocations, and so forth). Moreover, the transmitter 4218 and receiver 4220 may be coupled to one or more antennas (e.g., antenna 4222) and may share circuit components, software or firmware, or alternatively be implemented separately.

[0110] In the illustrated embodiment, communication functions of the communication interface 4212 may include cellular communication, Wi-Fi communication, LPWAN communication, data communication, voice communication, multimedia communication, short- range communications such as Bluetooth, near-field communication, location-based communication such as the use of the global positioning system (GPS) to determine a location, another like communication function, or any combination thereof. Communications may be implemented according to one or more communication protocols and / or standards, such as IEEE 802.11, Code Division Multiplexing Access (CDMA), Wideband Code Division Multiple Access (WCDMA), GSM, LTE, New Radio (NR), UMTS, WiMax, Ethernet, transmission control protocol / internet protocol (TCP / IP), synchronous optical networking (SONET), Asynchronous Transfer Mode (ATM), QUIC, Hypertext Transfer Protocol (HTTP), and so forth.

[0111] Regardless of the type of sensor, a UE may provide an output of data captured by its sensors, through its communication interface 4212, via a wireless connection to a network node. Data captured by sensors of a UE can be communicated through a wireless connection to a network node via another UE. The output may be periodic (e.g., once every 15 minutes if it reports the sensed temperature), random (e.g., to even out the load from reporting from several sensors), in response to a triggering event (e.g., when moisture is detected an alert is sent), in response to a request (e.g., a user initiated request), or a continuous stream (e.g., a live video feed of a patient).

[0112] As another example, a UE comprises an actuator, a motor, or a switch, related to a communication interface configured to receive wireless input from a network node via a wireless connection. In response to the received wireless input the states of the actuator, the motor, or theswitch may change. For example, the UE may comprise a motor that adjusts the control surfaces or rotors of a drone in flight according to the received input or to a robotic arm performing a medical procedure according to the received input.

[0113] A UE, when in the form of an Internet of Things (loT) device, may be a device for use in one or more application domains, these domains comprising, but not limited to, city, wearable technology, extended industrial application, and healthcare. Non-limiting examples of such an loT device are a device which is or which is embedded in: a connected refrigerator or freezer, a TV, a connected lighting device, an electricity meter, a robot vacuum cleaner, a voice controlled smart speaker, a home security camera, a motion detector, a thermostat, a smoke detector, a door / window sensor, a flood / moisture sensor, an electrical door lock, a connected doorbell, an air conditioning system like a heat pump, an autonomous vehicle, a connected vehicle, a surveillance system, a weather monitoring device, a vehicle parking monitoring device, an electric vehicle charging station, a smart watch, a fitness tracker, a head-mounted display for Augmented Reality (AR) or Virtual Reality (VR), a wearable for tactile augmentation or sensory enhancement, a water sprinkler, an animal- or item-tracking device, a sensor for monitoring a plant or animal, an industrial robot, an Unmanned Aerial Vehicle (UAV), and any kind of medical device, like a heart rate monitor or a remote controlled surgical robot. A UE in the form of an loT device comprises circuitry and / or software in dependence of the intended application of the loT device in addition to other components as described in relation to the UE 4200 shown in Figure 14.

[0114] As yet another specific example, in an loT scenario, a UE may represent a machine or other device that performs monitoring and / or measurements, and transmits the results of such monitoring and / or measurements to another UE and / or a network node. The UE may in this case be an M2M device, which may in a 3GPP context be referred to as an MTC device. As one particular example, the UE may implement the 3GPP NB-IoT standard. In other scenarios, a UE may represent a vehicle, such as a car, a bus, a truck, a ship and an airplane, or other equipment that is capable of monitoring and / or reporting on its operational status or other functions associated with its operation.

[0115] In practice, any number of UEs may be used together with respect to a single use case. For example, a first UE might be or be integrated in a drone and provide the drone’s speed information (obtained through a speed sensor) to a second UE that is a remote controller operating the drone. When the user makes changes from the remote controller, the first UE may adjust the throttle on the drone (e.g. by controlling an actuator) to increase or decrease the drone’s speed. The first and / or the second UE can also include more than one of the functionalities describedabove. For example, a UE might comprise the sensor and the actuator, and handle communication of data for both the speed sensor and the actuators.

[0116] Figure 15 shows a network node 5300 in accordance with some embodiments. As used herein, network node refers to equipment capable, configured, arranged and / or operable to communicate directly or indirectly with a UE and / or with other network nodes or equipment, in a telecommunication network. Examples of network nodes include, but are not limited to, computing devices, access points (APs) (e.g., radio access points), base stations (BSs) (e.g., radio base stations, Node Bs, evolved Node Bs (eNBs) and NR NodeBs (gNBs)), O-RAN nodes or components of an O-RAN node (e.g., O-RU, O-DU, O-CU).

[0117] Base stations may be categorized based on the amount of coverage they provide (or, stated differently, their transmit power level) and so, depending on the provided amount of coverage, may be referred to as femto base stations, pico base stations, micro base stations, or macro base stations. A base station may be a relay node or a relay donor node controlling a relay. A network node may also include one or more (or all) parts of a distributed radio base station such as centralized digital units, distributed units (e.g., in an O-RAN access node) and / or remote radio units (RRUs), sometimes referred to as Remote Radio Heads (RRHs). Such remote radio units may or may not be integrated with an antenna as an antenna integrated radio. Parts of a distributed radio base station may also be referred to as nodes in a distributed antenna system (DAS).

[0118] Other examples of network nodes include multiple transmission point (multi-TRP) 5G access nodes, multi-standard radio (MSR) equipment such as MSR BSs, network controllers such as radio network controllers (RNCs) or base station controllers (BSCs), base transceiver stations (BTSs), transmission points, transmission nodes, multi-ccll / multicast coordination entities (MCEs), Operation and Maintenance (O&M) nodes, Operations Support System (OSS) nodes, Self-Organizing Network (SON) nodes, positioning nodes (e.g., Evolved Serving Mobile Location Centers (E-SMLCs)), and / or Minimization of Drive Tests (MDTs).

[0119] The network node 5300 includes a processing circuitry 5302, a memory 5304, a communication interface 5306, and a power source 5308. The network node 5300 may be composed of multiple physically separate components (e.g., a NodeB component and a RNC component, or a BTS component and a BSC component, etc.), which may each have their own respective components. In certain scenarios in which the network node 5300 comprises multiple separate components (e.g., BTS and BSC components), one or more of the separate components may be shared among several network nodes. For example, a single RNC may control multiple NodeBs. In such a scenario, each unique NodeB and RNC pair, may in some instances be considered a single separate network node. In some embodiments, the network node 5300 may beconfigured to support multiple radio access technologies (RATs). In such embodiments, some components may be duplicated (e.g., separate memory 5304 for different RATs) and some components may be reused (e.g., a same antenna 5310 may be shared by different RATs). The network node 5300 may also include multiple sets of the various illustrated components for different wireless technologies integrated into network node 5300, for example GSM, WCDMA, LTE, NR, WiFi, Zigbee, Z-wave, LoRaWAN, Radio Frequency Identification (RFID) or Bluetooth wireless technologies. These wireless technologies may be integrated into the same or different chip or set of chips and other components within network node 5300.

[0120] The processing circuitry 5302 may comprise a combination of one or more of a microprocessor, controller, microcontroller, central processing unit, digital signal processor, application-specific integrated circuit, field programmable gate array, or any other suitable computing device, resource, or combination of hardware, software and / or encoded logic operable to provide, either alone or in conjunction with other network node 5300 components, such as the memory 5304, to provide network node 5300 functionality.

[0121] In some embodiments, the processing circuitry 5302 includes a system on a chip (SOC). In some embodiments, the processing circuitry 5302 includes one or more of radio frequency (RF) transceiver circuitry 5312 and baseband processing circuitry 5314. In some embodiments, the radio frequency (RF) transceiver circuitry 5312 and the baseband processing circuitry 5314 may be on separate chips (or sets of chips), boards, or units, such as radio units and digital units. In alternative embodiments, part or all of RF transceiver circuitry 5312 and baseband processing circuitry 5314 may be on the same chip or set of chips, boards, or units.

[0122] The memory 5304 may comprise any form of volatile or non-volatile computer- readable memory including, without limitation, persistent storage, solid-state memory, remotely mounted memory, magnetic media, optical media, random access memory (RAM), read-only memory (ROM), mass storage media (for example, a hard disk), removable storage media (for example, a flash drive, a Compact Disk (CD) or a Digital Video Disk (DVD)), and / or any other volatile or non-volatile, non-transitory device -readable and / or computer-executable memory devices that store information, data, and / or instructions that may be used by the processing circuitry 5302. The memory 5304 may store any suitable instructions, data, or information, including a computer program, software, an application including one or more of logic, rules, code, tables, and / or other instructions capable of being executed by the processing circuitry 5302 and utilized by the network node 5300. The memory 5304 may be used to store any calculations made by the processing circuitry 5302 and / or any data received via the communication interface 5306. In some embodiments, the processing circuitry 5302 and memory 5304 is integrated.

[0123] The communication interface 5306 is used in wired or wireless communication of signaling and / or data between a network node, access network, and / or UE. As illustrated, the communication interface 5306 comprises port(s) / terminal(s) 5316 to send and receive data, for example to and from a network over a wired connection. The communication interface 5306 also includes radio front-end circuitry 5318 that may be coupled to, or in certain embodiments a part of, the antenna 5310. Radio front-end circuitry 5318 comprises filters 5320 and amplifiers 5322. The radio front-end circuitry 5318 may be connected to an antenna 5310 and processing circuitry 5302. The radio front-end circuitry may be configured to condition signals communicated between antenna 5310 and processing circuitry 5302. The radio front-end circuitry 5318 may receive digital data that is to be sent out to other network nodes or UEs via a wireless connection. The radio frontend circuitry 5318 may convert the digital data into a radio signal having the appropriate channel and bandwidth parameters using a combination of filters 5320 and / or amplifiers 5322. The radio signal may then be transmitted via the antenna 5310. Similarly, when receiving data, the antenna 5310 may collect radio signals which are then converted into digital data by the radio front-end circuitry 5318. The digital data may be passed to the processing circuitry 5302. In other embodiments, the communication interface may comprise different components and / or different combinations of components.

[0124] In certain alternative embodiments, the network node 5300 does not include separate radio front-end circuitry 5318, instead, the processing circuitry 5302 includes radio front-end circuitry and is connected to the antenna 5310. Similarly, in some embodiments, all or some of the RF transceiver circuitry 5312 is part of the communication interface 5306. In still other embodiments, the communication interface 5306 includes one or more ports or terminals 5316, the radio front-end circuitry 5318, and the RF transceiver circuitry 5312, as part of a radio unit (not shown), and the communication interface 5306 communicates with the baseband processing circuitry 5314, which is part of a digital unit (not shown).

[0125] The antenna 5310 may include one or more antennas, or antenna arrays, configured to send and / or receive wireless signals. The antenna 5310 may be coupled to the radio front-end circuitry 5318 and may be any type of antenna capable of transmitting and receiving data and / or signals wirelessly. In certain embodiments, the antenna 5310 is separate from the network node 5300 and connectable to the network node 5300 through an interface or port.

[0126] The antenna 5310, communication interface 5306, and / or the processing circuitry 5302 may be configured to perform any receiving operations and / or certain obtaining operations described herein as being performed by the network node. Any information, data and / or signals may be received from a UE, another network node and / or any other network equipment. Similarly,the antenna 5310, the communication interface 5306, and / or the processing circuitry 5302 may be configured to perform any transmitting operations described herein as being performed by the network node. Any information, data and / or signals may be transmitted to a UE, another network node and / or any other network equipment.

[0127] The power source 5308 provides power to the various components of network node 5300 in a form suitable for the respective components (e.g., at a voltage and current level needed for each respective component). The power source 5308 may further comprise, or be coupled to, power management circuitry to supply the components of the network node 5300 with power for performing the functionality described herein. For example, the network node 5300 may be connectable to an external power source (e.g., the power grid, an electricity outlet) via an input circuitry or interface such as an electrical cable, whereby the external power source supplies power to power circuitry of the power source 5308. As a further example, the power source 5308 may comprise a source of power in the form of a battery or battery pack which is connected to, or integrated in, power circuitry. The battery may provide backup power should the external power source fail.

[0128] Embodiments of the network node 5300 may include additional components beyond those shown in Figure 15 for providing certain aspects of the network node’s functionality, including any of the functionality described herein and / or any functionality necessary to support the subject matter described herein. For example, the network node 5300 may include user interface equipment to allow input of information into the network node 5300 and to allow output of information from the network node 5300. This may allow a user to perform diagnostic, maintenance, repair, and other administrative functions for the network node 5300.

[0129] Figure 16 is a block diagram of a computing device 6400 in accordance with some embodiments. The computing device can include at least one of a network node, a computer, a server, and O-RAN nodes or components of an O-RAN node (e.g., SMO).

[0130] As shown in Figure 16, the computing device 6400 includes processing circuitry 6402 that is operatively coupled to memory 6404, and communication interface 6406, and / or any other component, or any combination thereof. Certain computing devices may utilize all or a subset of the components shown in Figure 16. The level of integration between the components may vary from one computing device to another computing device. Further, certain computing devices may contain multiple instances of a component, such as multiple processors, memories, etc.

[0131] The processing circuitry 6402 is configured to process instructions and data and may be configured to implement any sequential state machine operative to execute instructions stored as machine-readable computer programs in the memory 6404 and / or ZT anomaly trafficmanagement 6418 and / or its components M&A 200 and / or one or more ML models (shown as NAD 210). The processing circuitry 6402 may be implemented as one or more hardware- implemented state machines (e.g., in discrete logic, FPGAs, ASICs, etc.); programmable logic together with appropriate firmware; one or more stored computer programs, general-purpose processors, such as a microprocessor or DSP, together with appropriate software; or any combination of the above. For example, the processing circuitry 6402 may include multiple CPUs.

[0132] In the example, the communication interface 6406 may be configured to provide an interface or interfaces to an input device, output device, or one or more input and / or output devices. Examples of an output device include a display, a monitor, a printer, another output device, or any combination thereof. An input device may allow a user to capture information into the computing device 6400. Examples of an input device include a touch- sensitive or presencesensitive display, a camera (e.g., a digital camera, a digital video camera, a web camera, etc.), a microphone, a sensor, a mouse, a trackball, a directional pad, a trackpad, a scroll wheel, a smartcard, and the like. The presence-sensitive display may include a capacitive or resistive touch sensor to sense input from a user. A sensor may be, for instance, a force sensor, an optical sensor, a proximity sensor, a biometric sensor, etc., or any combination thereof. An output device may use the same type of interface port as an input device. For example, a USB port may be used to provide an input device and an output device.

[0133] The memory 6404 and / or ZT anomaly traffic management 6418 and / or its components may be or be configured to include memory such as RAM, ROM, PROM, EPROM, EEPROM, magnetic disks, optical disks, hard disks, removable cartridges, flash drives, and so forth. In one example, the memory 6404 and / or ZT anomaly traffic management 6418 and / or its components includes one or more application programs, such as an operating system, web browser application, a widget, gadget engine, or other application, and corresponding data. The memory 6404 and / or ZT anomaly traffic management 6418 and / or its components may store, for use by the computing device 6400, any of a variety of various operating systems or combinations of operating systems.

[0134] The memory 6404 and / or ZT anomaly traffic management 6418 and / or its components may be configured to include a number of physical drive units, such as RAID, flash memory, USB flash drive, external hard disk drive, thumb drive, pen drive, key drive, HD-DVD optical disc drive, internal hard disk drive, Blu-Ray optical disc drive, HDDS optical disc drive, external miniDIMM, SDRAM, external micro-DIMM SDRAM, smartcard memory such as tamper resistant module in the form of a UICC including one or more SIMs, such as a USIM and / or ISIM, other memory, or any combination thereof. The UICC may for example be an eUICC, iUICC or a removable UICC commonly known as ‘SIM card.’ The memory 6404 and / or ZT anomaly trafficmanagement 6418 and / or its components may allow the computing device 6400 to access instructions, application programs and the like, stored on transitory or non-transitory memory media, to off-load data, or to upload data. An article of manufacture, such as one utilizing a communication system may be tangibly embodied as or in the memory 6404 and / or ZT anomaly traffic management 6418 and / or its components which may be or comprise a device-readable storage medium.

[0135] The processing circuitry 6402 may be configured to communicate with a network using the communication interface 6406. The communication interface 6406 may comprise one or more communication subsystems. The communication interface 6406 may include one or more transceivers used to communicate, such as by communicating with one or more remote transceivers of another device capable of wireless communication (e.g., another computing device, local computing device, edge node, cloud node, etc.). Each transceiver may include a transmitter and / or a receiver appropriate to provide network communications (e.g., optical, electrical, and so forth).

[0136] In the illustrated embodiment, communication functions of the communication interface 6406 may include cellular communication, Wi-Fi communication, LPWAN communication, data communication, voice communication, multimedia communication, short- range communications such as Bluetooth, near-field communication, location-based communication such as the use of the GPS to determine a location, another like communication function, or any combination thereof. Communications may be implemented according to one or more communication protocols and / or standards, such as IEEE 802.11, CDMA, WCDMA, GSM, LTE, NR, UMTS, WiMax, Ethernet, TCP / IP, SONET, ATM, QUIC, HTTP, and so forth.

[0137] Figure 17 is a block diagram illustrating a virtualization environment 7500 in which functions implemented by some embodiments may be virtualized. In the present context, virtualizing means creating virtual versions of apparatuses or devices which may include virtualizing hardware platforms, storage devices and networking resources. As used herein, virtualization can be applied to any device described herein, or components thereof, and relates to an implementation in which at least a portion of the functionality is implemented as one or more virtual components. Some or all of the functions described herein may be implemented as virtual components executed by one or more virtual machines (VMs) implemented in one or more virtual environments 7500 hosted by one or more of hardware nodes, such as a hardware computing device that operates as a computing device, network node, UE, core network node, or host. Further, in embodiments in which the virtual node does not require radio connectivity (e.g., a core network node or host), then the node may be entirely virtualized. In some embodiments, thevirtualization environment 7500 includes components defined by the O-RAN Alliance, such as an O-Cloud environment orchestrated by a SMO 7510 Framework via an O-2 interface.

[0138] Applications 7502 (which may alternatively be called software instances, virtual appliances, network functions, virtual nodes, virtual network functions, etc.) are run in the virtualization environment 7500 to implement some of the features, functions, and / or benefits of some of the embodiments disclosed herein.

[0139] Hardware 7504 includes processing circuitry, memory that stores software and / or instructions executable by hardware processing circuitry, and / or other hardware devices as described herein, such as a network interface, input / output interface, and so forth. Software may be executed by the processing circuitry to instantiate one or more virtualization layers 7506 (also referred to as hypervisors or virtual machine monitors (VMMs)), provide VMs 7508a and 7508b (one or more of which may be generally referred to as VMs 7508), and / or perform any of the functions, features and / or benefits described in relation with some embodiments described herein. The virtualization layer 7506 may present a virtual operating platform that appears like networking hardware to the VMs 7508.

[0140] The VMs 7508 comprise virtual processing, virtual memory, virtual networking or interface and virtual storage, and may be run by a corresponding virtualization layer 7506. Different embodiments of the instance of a virtual appliance 7502 may be implemented on one or more of VMs 7508, and the implementations may be made in different ways. Virtualization of the hardware is in some contexts referred to as network function virtualization (NFV). NFV may be used to consolidate many network equipment types onto industry standard high volume server hardware, physical switches, and physical storage, which can be located in data centers, and customer premise equipment.

[0141] In the context of NFV, a VM 7508 may be a software implementation of a physical machine that runs programs as if they were executing on a physical, non-virtualized machine. Each of the VMs 7508, and that part of hardware 7504 that executes that VM, be it hardware dedicated to that VM and / or hardware shared by that VM with others of the VMs, forms separate virtual network elements. Still in the context of NFV, a virtual network function is responsible for handling specific network functions that run in one or more VMs 7508 on top of the hardware 7504 and corresponds to the application 7502.

[0142] Hardware 7504 may be implemented in a standalone network node with generic or specific components. Hardware 7504 may implement some functions via virtualization. Alternatively, hardware 7504 may be part of a larger cluster of hardware (e.g. such as in a data center or CPE) where many hardware nodes work together and are managed via management andorchestration (SMO) 7510, which, among others, oversees lifecycle management of applications 7502. In some embodiments, hardware 7504 is coupled to one or more radio units that each include one or more transmitters and one or more receivers that may be coupled to one or more antennas. Radio units may communicate directly with other hardware nodes via one or more appropriate network interfaces and may be used in combination with the virtual components to provide a virtual node with radio capabilities, such as a radio access node or a base station. In some embodiments, some signaling can be provided with the use of a control system 7512 which may alternatively be used for communication between hardware nodes and radio units.

[0143] Although the computing device described herein may include the illustrated combination of hardware components, other embodiments may comprise computing devices with different combinations of components. It is to be understood that these computing devices may comprise any suitable combination of hardware and / or software needed to perform the tasks, features, functions and methods disclosed herein. Determining, calculating, obtaining or similar operations described herein may be performed by processing circuitry, which may process information by, for example, converting the obtained information into other information, comparing the obtained information or converted information to information stored in the computing device, and / or performing one or more operations based on the obtained information or converted information, and as a result of said processing making a determination. Moreover, while components are depicted as single boxes located within a larger box, or nested within multiple boxes, in practice, computing devices may comprise multiple different physical components that make up a single illustrated component, and functionality may be partitioned between separate components. For example, a communication interface may be configured to include any of the components described herein, and / or the functionality of the components may be partitioned between the processor and the network interface. In another example, non- computationally intensive functions of any of such components may be implemented in software or firmware and computationally intensive functions may be implemented in hardware.

[0144] In certain embodiments, some or all of the functionality described herein may be provided by processing circuitry executing instructions stored on in memory, which in certain embodiments may be a computer program product in the form of a non-transitory computer- readable storage medium. In alternative embodiments, some or all of the functionality may be provided by the processing circuitry without executing instructions stored on a separate or discrete device-readable storage medium, such as in a hard-wired manner. In any of those particular embodiments, whether executing instructions stored on a non-transitory computer-readable storage medium or not, the processing circuitry can be configured to perform the describedfunctionality. The benefits provided by such functionality are not limited to the processing circuitry alone or to other components of the computing device, but are enjoyed by the computing device as a whole, and / or by end users and a wireless network generally.

[0145] In certain embodiments, a computing device (6400) is provided. The computing device is configured for ZT anomaly traffic management for a network. The computing device includes processing circuitry 6402; and memory 6404 coupled with the processing circuitry. The memory includes instructions that when executed by the processing circuitry causes the computing device to perform operations. The operations include to perform some or all of the functionality described herein.

[0146] In certain embodiments, a non- transitory computer readable medium 6404 including program code to be executed by processing circuitry 6402 of a computing device 6400 is configured ZT anomaly traffic management for a network. Execution of the program code causes the program code to perform operations. The operations include to perform some or all of the functionality described herein.

[0147] Further definitions and embodiments are discussed below.

[0148] In the above-description of certain embodiments of the present disclosure, it is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the present disclosure. Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which concepts of the present disclosure belong. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of this specification and the relevant art and will not be interpreted in an idealized or overly formal sense unless expressly so defined herein.

[0149] When an element is referred to as being “connected”, “coupled”, “responsive”, or variants thereof to another element, it can be directly connected, coupled, or responsive to the other element or intervening elements may be present. In contrast, when an element is referred to as being “directly connected”, “directly coupled”, “directly responsive”, or variants thereof to another element, there are no intervening elements present. Like numbers refer to like elements throughout. Furthermore, “coupled”, “connected”, “responsive”, or variants thereof as used herein may include wirelessly coupled, connected, or responsive. As used herein, the singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. Well-known functions or constructions may not be described in detail for brevity and / orclarity. The term “and / or” (abbreviated “ / ”) includes any and all combinations of one or more of the associated listed items.

[0150] It will be understood that although the terms first, second, third, etc. may be used herein to describe various elements / operations, these elements / operations should not be limited by these terms. These terms are only used to distinguish one element / operation from another element / operation. Thus a first element / operation in some embodiments could be termed a second element / operation in other embodiments without departing from the teachings of concepts of the present disclosure. The same reference numerals or the same reference designators denote the same or similar elements throughout the specification.

[0151] As used herein, the terms “comprise”, “comprising”, “comprises”, “include”, “including”, “includes”, “have”, “has”, “having”, or variants thereof are open-ended, and include one or more stated features, integers, elements, steps, components, or functions but does not preclude the presence or addition of one or more other features, integers, elements, steps, components, functions, or groups thereof. Furthermore, as used herein, the common abbreviation “e.g.”, which derives from the Latin phrase “exempli gratia,” may be used to introduce or specify a general example or examples of a previously mentioned item, and is not intended to be limiting of such item. The common abbreviation “i.e.”, which derives from the Latin phrase “id est,” may be used to specify a particular item from a more general recitation.

[0152] Example embodiments are described herein with reference to block diagrams and / or flowchart illustrations of computer-implemented methods, apparatus (systems and / or devices) and / or computer program products. It is understood that a block of the block diagrams and / or flowchart illustrations, and combinations of blocks in the block diagrams and / or flowchart illustrations, can be implemented by computer program instructions that are performed by one or more computer circuits. These computer program instructions may be provided to a processor circuit of a general purpose computer circuit, special purpose computer circuit, and / or other programmable data processing circuit to produce a machine, such that the instructions, which execute via the processor of the computer and / or other programmable data processing apparatus, transform and control transistors, values stored in memory locations, and other hardware components within such circuitry to implement the functions / acts specified in the block diagrams and / or flowchart block or blocks, and thereby create means (functionality) and / or structure for implementing the functions / acts specified in the block diagrams and / or flowchart block(s).

[0153] These computer program instructions may also be stored in a tangible computer- readable medium that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable mediumproduce an article of manufacture including instructions which implement the functions / acts specified in the block diagrams and / or flowchart block or blocks. Accordingly, embodiments of the present disclosure may be embodied in hardware and / or in software (including firmware, resident software, micro-code, etc.) that runs on a processor such as a digital signal processor, which may collectively be referred to as “circuitry,” “a module” or variants thereof.

[0154] It should also be noted that in some alternate implementations, the functions / acts noted in the blocks may occur out of the order noted in the flowcharts. For example, two blocks shown in succession may in fact be executed substantially concurrently or the blocks may sometimes be executed in the reverse order, depending upon the functionality / acts involved. Moreover, the functionality of a given block of the flowcharts and / or block diagrams may be separated into multiple blocks and / or the functionality of two or more blocks of the flowcharts and / or block diagrams may be at least partially integrated. Finally, other blocks may be added / inserted between the blocks that are illustrated, and / or blocks / operations may be omitted without departing from the scope of the present disclosure. Moreover, although some of the diagrams include arrows on communication paths to show a primary direction of communication, it is to be understood that communication may occur in the opposite direction to the depicted arrows.

[0155] Many variations and modifications can be made to the embodiments without substantially departing from the principles of the present disclosure. All such variations and modifications are intended to be included herein within the scope of the present disclosure. Accordingly, the above disclosed subject matter is to be considered illustrative, and not restrictive, and the examples of embodiments are intended to cover all such modifications, enhancements, and other embodiments, which fall within the spirit and scope of the present disclosure. Thus, to the maximum extent allowed by law, the scope of the present disclosure is to be determined by the broadest permissible interpretation of the present disclosure including the examples of embodiments and their equivalents, and shall not be restricted or limited by the foregoing detailed description.

Claims

Claims:

1. A computer-implemented method for zero trust anomaly traffic management for a network, the method comprising: analyzing (1104) traffic data communicated from a network function consumer, NFC, towards a network function provider, NFP, to obtain an identification of whether the traffic data comprises a security anomaly; and performing (1108) one of (i) responsive to the identification comprising that a security anomaly is not identified in the traffic data, initiate keeping a routing policy for the NFP to handle the traffic data, and (ii) responsive to the identification comprising that a security anomaly is identified in the traffic data, initiate a first update of the routing policy to redirect the traffic data from the NFC to a dedicated network function producer, dNFP.

2. The method of Claim 1, wherein the analyzing (1104) and the performing (1108) is performed by at least one of a first statistical based model and a first machine learning, ML, model.

3. The method of any one of Claims 1 to 2, further comprising: collecting (1102) the traffic data from the NFP.

4. The method of any one of Claims 1 to 3, further comprising: identifying (1106) the NFC or a user equipment, UE, associated with the security anomaly.

5. The method of any one of Claims 1 and 4, further comprising: responsive to the first update of the routing policy, analyzing (1110) the dNFP to obtain a verification of whether the security anomaly comprises an anomalous traffic pattern or a non- anomalous traffic pattern; and performing (1112) one of (i) responsive to verification that the security anomaly comprises an anomalous traffic pattern, initiate a second update of the routing policy for the NFP to accept the traffic data, and (ii) responsive to verification that the security anomaly comprises a non-anomalous traffic pattern, initiate an adjustment to the routing policy to route the traffic data back onto the NFP.

6. The method of Claim 5, further comprising: initiating (1114) an alarm responsive to the verification that the security anomalycomprises an anomalous traffic pattern.

7. The method of any one of Claims 5 to 6, wherein the analyzing (1110) and the performing (1112) is performed by at least one of a second statistical model and a second machine learning, ML, model.

8. The method of any one of Claims 5 to 7, furth comprising: collecting (1200) the security anomaly from the dNFP.

9. The method of any one of Claim 5 to 8, wherein the analyzing (1110) the dNFP comprises a detection of whether an attack occurred on the network from the security anomaly in a specified time period.

10. The method of any one of Claim 5 to 9, wherein (i) further comprises identify the NFC from which the security anomaly originates, and (ii) further comprises initiate an adjustment to the routing policy to route the traffic data back onto the NFP comprises initiate the second update to accept the traffic data.

11. The method of any one of Claims 5 to 10, further comprising: clearing (1202) the alarm.

12. The method of any one of Claims 3 to 11, wherein collecting (1200) the traffic data from the NFP comprises collecting the traffic data from at least one of an access log, a data packet, and a key performance indicator, KPI.

13. The method of any one of Claims 1 to 12, wherein the traffic data communicated from a network function consumer, NFC, towards a network function provider, NFP comprises a service communication proxy, SCP, between the NFC and the NFP, and wherein the traffic data is communicated from the NFC to the SCP and from the SCP to the NFP.

14. The method of any one of Claims 1 to 13, further comprising: launching (1100) an instance of the NFP to provide zero trust anomaly traffic management for a network.

15. The method of any one of Claims 1 to 15, wherein the network comprises at least one of a telecommunications network and an open radio access network, O-RAN.

16. A computing device (6400) configured for zero trust anomaly traffic management for a network, the computing device comprising: processing circuitry (6402); memory (6404) coupled with the processing circuitry, wherein the memory includes instructions that when executed by the processing circuitry causes the computing device to perform operations comprising: analyze traffic data communicated from a network function consumer, NFC, towards a network function provider, NFP, to obtain an identification of whether the traffic data comprises a security anomaly; and perform one of (i) responsive to the identification comprising that a security anomaly is not identified in the traffic data, initiate keeping a routing policy for the NFP to handle the traffic data, and (ii) responsive to the identification comprising that a security anomaly is identified in the traffic data, initiate a first update of the routing policy to redirect the traffic data from the NFC to a dedicated network function producer, dNFP.

17. The computing device of Claim 16, wherein the operations further comprise any of the operations of Claims 2-15.

18. A non-transitory computer readable medium (6404) including program code to be executed by processing circuitry (6402) of a computing device (6400) configured for zero trust anomaly traffic management for a network, whereby execution of the program code causes the program code to perform operations comprising: analyze traffic data communicated from a network function consumer, NFC, towards a network function provider, NFP, to obtain an identification of whether the traffic data comprises a security anomaly; and perform one of (i) responsive to the identification comprising that a security anomaly is not identified in the traffic data, initiate keeping a routing policy for the NFP to handle the traffic data, and (ii) responsive to the identification comprising that a security anomaly is identified in the traffic data, initiate a first update of the routing policy to redirect the traffic data from the NFC to a dedicated network function producer, dNFP.

19. The non-transitory computer readable medium of Claim 18, the operations further comprising any of the operations of Claims 2-15.

Images