System for security orchestration in communication networks

Abstract

A computer-implemented system (100) for a communications network. The system comprises a security orchestration function (101). The security orchestration function is configured to manage a plurality of security proxy functions (102). The security orchestration function is further configured to interoperate with a network management function and a network security management function. The system comprises the plurality of security proxy functions. The security proxy functions host security capabilities on behalf of network services and / or applications. The system further comprises a service exposure API (103), the service exposure API configured to abstract network capabilities between the security orchestration function and network data consumers.

Description

[0001] SYSTEM FOR SECURITY ORCHESTRATION IN COMMUNICATION NETWORKS TECHNICAL FIELD

[0002] The disclosure relates broadly to security in a communications network, and more specifically to a computer-implemented system and method for cryptographic agility. Further disclosed are related computer programs and computer program products. BACKGROUND

[0003] Rapid developments in the field of cryptography mean that, once deployed, security management systems may quickly become outdated. For example the National Institute for Standards and Technology (NIST) emphasizes that it is imperative for security management systems to focus on cryptographic agility to meet new threats, such as those potentially indicated by quantum computing. Cryptographic agility means the concept of implementing, updating, configuring, and removing cryptographic functions used by systems and applications on demand, without having to rebuild the system itself (NISTIR 8105 “Report on Post-Quantum Cryptography, Chen, Lily et. al., April 2016, http: / / dx.doi.org / 10.6028 / NIST.IR.8105). The scale of communication networks is constantly growing and the along with handling an increasing amount of data, the networks also handle more sensitive data. By way of example, network users may handle banking, make medical appointments and access medical test results, and handle legal issues, including e.g. sharing and digitally signing contracts using communications networks. It is therefore essential that communications networks can provide appropriate levels of security for the data handled.

[0004] In the last few years cryptography has shifted from a generic “set and forget” use paradigm to a managed use paradigm. The term managed highlights that cryptographic algorithms and security logics in general must be carefully selected, implemented, maintained and retired from service according to requirements such as:

[0005] • the information protected;

[0006] • the length of time that information needs to remain secret or secure;

[0007] the platforms the algorithms operate on;• the regulatory environment the algorithms operate in; and

[0008] • newly discovered vulnerabilities and mathematical attacks, including the emergence of quantum computers at a sufficiently strong scale to threaten classic cryptography.

[0009] Managed cryptography is the opposite of “set and forget” implementations that are the norm. In historical systems, cryptographic algorithms have been hard-coded into operating systems and applications by manufacturers and left in place, forever. This static profile makes it difficult to change the security algorithm if any of the above requirements change or evolve and leaves the underlying cryptography, and by extension, the system or application that relies on it, no longer fit for purpose or compliant.

[0010] Standing current ecosystem’s immaturity, in order to be able to start migrating to evolved cryptographic solutions, such as quantum-safe standards developed by NIST and beyond, it is of interest to pursue cryptographic agility. Cryptographic agility guarantees future-proofness of security solutions for libraries, protocols and applications, and at the same time, crypto-agile orchestration of the system.

[0011] This implies the ability to replace the cryptographic algorithms or even the implementations in use in a network with minimal disruption. A cryptographically agile system can rapidly respond to novel cryptanalysis or implementation bugs by easily swapping out or upgrading vulnerable cryptography. Crypto-agile orchestration also allows systems to take advantage of new implementations and to build smart services on top of them.

[0012] A challenge is therefore to manage cryptographic agility: the ability to change to a new algorithm, as per industry standards, without the need to rewrite applications or deploy new hardware systems along with crypto-agile orchestration: the ability to centrally view and manage cryptographic solutions. Developing cryptographically agile systems which can be deployed in communication networks and are suitable for crypto-agile orchestration is needed to address security challenges as they arise and ensure compliance with new and changing security standards.

[0013] SUMMARYIt is an object of the disclosure to present a cryptographically agile system for managing security in a network.

[0014] According to a first aspect, there is a computer-implemented system for a communications network. The system comprises a security orchestration function, the security orchestration function configured to manage a plurality of security proxy functions. The security orchestration function is further configured to interoperate with a network management function and a network security management function. The plurality of security proxy functions host security capabilities on behalf of network services and / or applications. The system comprises a service exposure application programming interface, API, the service exposure API configured to abstract network capabilities between the security orchestration function and network data consumers.

[0015] According to an embodiment of the first aspect, the plurality of security proxy functions embed libraries implementing cryptographic algorithms.

[0016] According to an embodiment of the first aspect, the security orchestration function is configured to expose a network security infrastructure to network data consumers via the service exposure API.

[0017] According to an embodiment of the first aspect, the plurality of security proxy functions are configured to expose North-Bound Interfaces, NBI, to interoperate with network management and orchestration entities of the network.

[0018] According to an embodiment of the first aspect, the plurality of security proxy functions are configured to change a cryptographic algorithm in use by a network consumer immediately on receipt of a request from the security orchestration function via the NBI.

[0019] According to an embodiment of the first aspect, the plurality of security proxy functions are configured to use embedded security capabilities together with external equipments and services exposed through the network. The external equipments and services comprise one or more of: a quantum random number generator, quantum key distribution, and entanglement distribution services.

[0020] According to an embodiment of the first aspect, the security orchestration function performs lifecycle management for the plurality of security proxy functions.According to an embodiment of the first aspect, the security orchestration function is configured to, jointly with the network management function of the network, instantiate secure connections between pairs of security proxy functions.

[0021] According to an embodiment of the first aspect, the security orchestration function is configured to instantiate secure connections between pairs of security proxy functions on demand from a communication service provider or consumer or automatically triggered by detection of a changed security context.

[0022] According to an embodiment of the first aspect, the security orchestration function implements one or more machine learning functions to assist with one or more of: monitoring of the network infrastructure; selection of security levels; network vulnerability assessment.

[0023] According to an embodiment of the first aspect, the security proxy functions are deployed for one or more of the following tasks:

[0024] to support inter-public land mobile network, inter-PLMN, connectivity;

[0025] to support intra-PLMN connectivity;

[0026] to support intra-network function connectivity; or

[0027] to support end-to-end communication at the network edge.

[0028] According to a second aspect, there is a network apparatus comprising a memory and a processor, the network apparatus configured to implement a system for a communications network. The system comprises a security orchestration function, the security orchestration function configured to manage a plurality of security proxy functions. The security orchestration function is further configured to interoperate with a network management function and a network security management function. The plurality of security proxy functions host security capabilities on behalf of network services and / or applications. The system comprises a service exposure application programming interface, API, the service exposure API configured to abstract network capabilities between the security orchestration function and network data consumers.

[0029] According to embodiment of the second aspect, the network apparatus is configured to implement the system according to any embodiment of the first aspect.According to a third aspect, there is a computer program comprising computer-readable instructions which, when executed by the processor of a network apparatus, cause the network apparatus to implement a system according to any embodiment of the first aspect.

[0030] According to a fourth aspect, there is a computer program product comprising a computer program according to the third aspect.

[0031] BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Fig. 1 is a block diagram of components of a security management system according to the disclosure.

[0033] Fig. 2 is a schematic overview of a communication network implementing a security management system according to the disclosure.

[0034] Fig. 3 is a flowchart of a method performed by a security management system according to the disclosure.

[0035] Fig. 4 depicts a 5G telecommunications system roaming architecture with local breakout with service-based interfaces with the control plane.

[0036] Fig. 5 is a schematic overview of a non-roaming service-based 5G reference architecture.

[0037] Fig. 6 is a schematic overview of a geographically distributed network function.

[0038] Fig. 7 is a schematic overview of communications at the network edge.

[0039] DETAILED DESCRIPTION OF THE DRAWINGS

[0040] Methods and systems presented herein relate to a network solution to cryptographic agility and orchestration, which is exposed as an external application programming interface (API) for communication service providers (CSPs) and consumers.

[0041] In particular, the methods and systems presented establish a network-agnostic Security-as-a-Service (SaaS) layer which may be effectively orchestrated. Network security is abstracted into a logical layer on top of the transport network by decoupling the network security layer from network traffic-handling entities.Embodiments presented herein will demonstrate how this may be achieved on different levels of the open systems interconnections (OSI) model. In particular, applications and protocols could be decoupled from SaaS by interposing standard APIs between the layers.

[0042] Alternatively, particularly fit for end-to-end (e2e) cryptography at the network edge, security functions may be isolated into dedicated, modular, portable and scalable network services to be deployed as needed.

[0043] These and other similar solutions would be provisioned, supervised, managed and orchestrated by a centralized logical entity able to interoperate with operations support system (OSS) or a business support system (BSS) and other Network Management infrastructures.

[0044] The external service exposure APIs may, for example, be implemented as a cascade comprising a network API operating in a service exposure logical layer, and a service API operating in an external service exposure logical layer. Implementations may use a standard API such as TM Forum Open APIs. Depending on the service to be exposed, specialized APIs for e.g. security functions, orchestration functions, voice functions, and / or loT functions may be used.

[0045] SaaS also enables the deployment of smart security services, possibly based on machine learning algorithms, such as e.g. the dynamic enforcement and assurance of a pre-defined level of security on a given piece of network, network path, or network slice based on the sensitivity of the data being exchanged or on specific requests by the end-user or the operator of the network or the operator of a service provided by the network, and on the availability in the underlying network of the necessary security infrastructures, equipments and capabilities.

[0046] Crypto-agile orchestration provides visibility into which algorithms, key sizes, key rotation policies or entropy sources any instance of cryptography is using, in addition to providing the means to easily swap out vulnerable or non-compliant instances. By working at the level of policy, orchestration can also ease the burden for organizations to meet current and future regulatory and compliance requirements at scale. Orchestration becomes increasingly important as the number of devices and applications in an organization increases due to computing trends such as Internet of Things (loT).The architecture of a crypto-agile, orchestrated network according to the disclosure comprises three layers:

[0047] • an application layer comprising the service exposure API is the topmost architectural layer and directly faces with users’ demands and abstracts network resources for users;

[0048] • a control layer which provides the operator with a holistic view of the crypto- agile, orchestrated network enabled by software-defined networking (SDN), where the application layer may comprise one or more controllers; and

[0049] • a network implementation layer which performs low-level network implementation, lies at the bottom of the architectural stack, implements a key distribution subsystem and can be used to enforce the desired end-to-end level and type of encryption in the network.

[0050] Fig. 1 is a block diagram of components of a security management system 100 according to the disclosure. The security management system 100 is a system providing flexible management of security in a communication network 200.

[0051] A security management system 100 is a software-based collection of functions deployed in a communication network 200 to perform security-related functions, such as for example providing access to libraries implementing cryptographic functions, distributing cryptographic keys, monitoring the network infrastructure, selecting security levels for communication between different entities of the communication network 200, and performing network vulnerability assessments. The security management system 100 may be implemented using SDN principles.

[0052] The security management system 100 comprises functions arranged in three layers, each of the three layers comprising security functions performing functions on different levels in the network 200.

[0053] A security orchestration function 101 corresponds to the network implementation layer of the security management system 100. The security orchestration function 101 comprises software implemented in a core network node of the communication network 200. Note that the core network node may be a virtual network node and / or distributed over a plurality of physical computing devices, so the security orchestration function being implemented “in” a core network node refers to a logicalposition of the software implementing the security orchestration function in the software defining the network 200 rather than a physical location of the software. In particular, the security orchestration function 101 is interoperable with a network management function (not shown) and a security management function (not shown) of the communication network 200. The network management function and the security management function are standard components of a network and are not comprised in the system 100. The security orchestration function manages the SaaS layer via north-bound interfaces (NBIs).

[0054] A security proxy function 102 implements the functions corresponding to the SaaS layer of the system by hosting security capabilities on behalf of applications and network services. By hosting security capabilities, the security proxy functions 102 abstract security by decoupling security capabilities from traffic sources. The security proxy function is a lightweight, modular, portable software service. In some embodiments, the security proxy function can be executed in a virtual network function (VNF) and / or a software container. The security proxy function 102 can thus be deployed anywhere in the network where the security proxy function is needed and the security proxy function can be pushed to the edge of the network 200, close to or co-located with end user applications to produce end-to-end encryption services.

[0055] The third layer of the system comprises a service exposure API 103 in the service exposure layer. The service exposure API 103 abstracts the crypto-agile network capabilities provided by the security proxy functions 102 via the security orchestration function 101 for communication service provider and consumer use. The service exposure API thus allows communication service providers and consumers to establish their own security requirements on the network.

[0056] Some examples of specific functions performed by the security orchestration function 101 will now be discussed.

[0057] The security orchestration function 101 may perform lifecycle management for the security proxy function 102 implementing the SaaS layer. Lifecycle management may include instantiating, configuring, activating, deactivating, and removing the security proxy function, replacing, updating, or upgrading the software of the securityproxy function, or interfacing with the security proxy function to perform troubleshooting.

[0058] The security orchestration function 101 may interoperate with the network management function to instantiate secure connections between two endpoints of the network 200 using state-of-the-art software algorithms such as quantum-safe cryptography algorithms using a pair of security proxy functions, one security proxy function located in each endpoint. Such a connection is implemented on top of the pre-existing network topology to provide additional security.

[0059] The security orchestration function 101 may further instantiate pre-defined security levels on one or more links interconnecting pairs of security proxy functions 102. Each security proxy function may be used as an endpoint for one or more links. The pre-defined security levels may be instantiated on-demand (from e.g. a service provider or a consumer), or automatically (e.g. triggered by a specific type of service). The pre-defined security level may further be selected based on the cryptographic capabilities of the involved security proxy functions, as well as the cryptographic capabilities of the underlying network structure. To perform this function, it is therefore important that the security orchestration function 101 and the network management function of the network 200 are interoperable, so that the security orchestration function can obtain information such as a list of impacted assets, a configuration of the assets, connectivity information, network topology information, and asset capability information for each pair of assets linked by a security proxy pair.

[0060] The security orchestration function 101 may further provide smart security functions using machine learning, such as intelligent automatic enforcement of security levels based on continuous monitoring and assessment of the network infrastructure evolution and topology, threat intelligence, and network vulnerability assessments. The security orchestration function 101 may further enforce a type and level of encryption between endpoints of the communication network.

[0061] The security orchestration function 101 may further expose the NBIs towards the service exposure API 103, to allow communication service providers and consumers additional control of the security level of their respective communication.The security orchestration function 101 may implement a key distribution subsystem of the system 100. The key distribution subsystem may generate and / or distribute cryptographic keys to the security proxy functions.

[0062] Some specific functions of the security proxy function 102 will now be discussed in more detail.

[0063] Preferably, the network 200 comprises a plurality of security proxy functions 102, each security proxy function configured to perform at least one or more of the following functions. Each of the plurality of security proxy functions 102 may be deployed to a different location of the network 200. As with the security orchestration function 101, the location of the security proxy functions 102 is a matter of internal logic of the network 200 rather than a strictly physical location.

[0064] The security proxy function 102 may embed libraries implementing cryptographic algorithms, including both well-established algorithms such as transport layer security (TLS), secure shell (SSH), Z real-time protocol (ZRTP), and internet protocol security (IPSec), and use-case specific or less established algorithms such as the quantum-safe algorithms established by NIST and any algorithms implementing any future cryptographic algorithm.

[0065] The security proxy function 102 may assist in key distribution by for example exposing APIs for cryptographic key distribution. For example, the network 200 may have access to hardware generating quantum keys, and the API may be an API for quantum key distribution to allow network users to fetch high entropy symmetric keys.

[0066] The security proxy functions 102 may expose NBIs to interoperate with management and orchestration entities (not shown) in the network 200.

[0067] The security proxy function 102 is built using a modular and scalable software architecture allowing fast and simple configuration, monitoring, upgrade, and replacement of algorithms and libraries. The modular architecture means that functions may be added or removed from the security proxy function as needed by the security management system 101.

[0068] In implementations where the security proxy function 102 is containerized, the interactions between each security proxy function and the security orchestrationfunction 101 may for example be implemented using a framework such as Kubernetes, Docker, or a specification according to the Open Container Initiative. The modular structure and centralized management via the NBI enables cryptographic agility by allowing the security proxy function 102 to change on the fly which algorithm is used with minimal impact on live traffic.

[0069] The security proxy function 102 is a software service completely decoupled and independent from the infrastructure and topology of the underlying network 200. The modular software structure allows implementing different cryptographic techniques separately or in combinations (hybrid security). The different cryptographic techniques include, by way of nonlimiting example, traditional telecommunications and internet security protocols, post-quantum, and quantum technologies. In particular, the security proxy function can use, in a network-agnostic way subject only to hardware limitations of the underlying physical network, security capabilities embedded in the security proxy functions in conjunction with external equipments and services exposed by the network (such as (quantum) key distribution services) exposed by the network infrastructure via APIs or in an as-a-service fashion. For example, the security proxy function may expose quantum random number generation services, quantum key distribution services, and any future security service / technology such as entanglement distribution services to traffic endpoints and / or network services and to users and / or orchestrators of services in the network. Some specific functions of the service exposure API 103 will now be discussed in more detail.

[0070] In particular, using the service exposure API 103, communication service providers and consumers may establish and enforce organization-wide or application-specific cryptography policies around using, modifying, and retiring cryptographic mechanisms to ensure the use of the most modem and state-of-the-art cryptographic solutions.

[0071] The service exposure API 103 is a self-bound API configured to interoperate with preexisting network infrastructure of the network 200. The service exposure API 103 is exposed to infrastructure, and hence the network becomes available to a communication service provider or consumer.The system comprising the security orchestration function 101, the security proxy functions 102, and the service exposure API 103 may also facilitate the introduction of newer cryptographic standards in telecommunication networks, such as quantumsafe algorithms, by enabling the deployment of the quantum-safe cryptography in the use cases where it is relevant with negligible impact on preexisting services, network connectivity, and network topology, and with no impact on network infrastructure. The flexibility enabled by the system 100 constitutes a future-proof approach to network security which transparently and adaptively follows the evolution of the physical network, while ensuring security flexibility, modularity, portability and scalability, enabling adoption and use in “as-a-Service” mode of new security technologies as they come to life and, above all, enabling zero-touch centralized management and orchestration of security resources.

[0072] The system 100 further allows communication service providers and consumers to associate the desired level of security to e.g. private telecommunications networks, communication links, or network slices allocated to specific services at deployment time with automated end-to-end procedures. The system 100 further allows communication service providers and consumers to modify, at any time, the desired level of network security of said private telecommunications networks, communication links, or network slices by reacting easily, quickly, and at scale to new cryptographic requirements or changing standards. The communication service providers and consumers may build and maintain an inventory of cryptographic assets which can be deployed by the security proxy functions 102, coordinated by the security orchestration function 101, and accessed through the service exposure API 103.

[0073] The communication network 200 is a network comprising a radio access network 201 and, optionally, a local area network 202. The radio access network 201 is created by radio access nodes 203a, 203b providing coverage to end user devices 204a, 204b and / or a wireless local access points 205 such as a router creating local area network (LAN) 203. The radio access network provides access to a core network 206. For clarity in terminology, embodiments presented herein use terminology consistent with 5G New Radio (5G) communication networks as defined by the 3rdGeneration Partnership Program (3GPP). However, the communicationnetwork can be any communication network according to any suitable standard, such as a 4G Long-Term Evolution (4G) network or a network according to a future standard such as 6G defined by 3GPP, or a network according to some standard defined by any other standardizing body such as the Institute of Electrical and Electronics Engineers (IEEE). Where the network includes a LAN, the LAN may be for example a Wi-Fi network, a Bluetooth network, a Zigbee network, or any other suitable local / personal area network.

[0074] Fig. 3 depicts an example of a process 300 performed by the system 100 illustrating a plurality of sub-methods for securing a small slice of the network 200. The process 300 should be read as non-limiting and solely for the purpose of presenting some examples of security triggers and corresponding actions / sub-methods of the system 100 such as a routine update, a non-scheduled update, interaction with security infrastructure of the network, and establishment of secure communications between devices of the network. In this simple example, the network comprises a core network node 206 where the security orchestration function 101 is deployed, a radio access node 203a, a first smartphone 204a with a security proxy function 102a, a second smartphone 204b with a corresponding security proxy function 102b, and network security infrastructure 207 including a QRNG (not pictured) with a corresponding security proxy function 102c. The first and second smartphones 204a, 204b are connected to the network 200 via the radio access node.

[0075] The process 300 comprises the security orchestration function 101 performing 302 a routine update for the security proxy function 102a of the first smartphone 204a, wherein the update is triggered by a specific time period elapsing 301 in the core network since the last update.

[0076] The process 300 comprises the security proxy function 102b of the second smartphone 204b detecting a corrupted file in a library of the security proxy function 102b and requesting, from the security orchestration function 101 in the core network node, an update. The process further comprises the security orchestration function 101 in the core network node and the security proxy function 102b performing 304 the update.

[0077] The process 300 comprises an application in the first smartphone requesting 305, from the security orchestration function 101 in the core network node via exposureAPI 103a in the first smartphone 204a, a random number. The security orchestration function 101 obtains 306, via the security proxy function proxy 102c at a QRNG, such a random number and transmits it to the first smartphone 204a.

[0078] The process 300 comprises the security proxy function 102a in the first smartphone and the security proxy function 102b in the second smartphone performing 307 a Diffie-Hellman key exchange for establishing a peer-to-peer connection between the first smartphone and the second smartphone. The Diffie-Hellman key exchange is performed 308 using the security orchestration function 101 in the core network node to provide the shared pseudorandom numbers and route the key exchange messages until the peer-to-peer link 309 can be secured by the shared key.

[0079] Some specific embodiments will now be disclosed in more detail, demonstrating how the security proxy functions 102 of the system 100 can be incorporated in a telecommunication network such as the communication network 200 as part of a service-based architecture (SBA). In these embodiments, the communication network 200 is a network according to 3GPP TS 23.501 V19.1.0. The specific network version is however not of importance for the invention, but one is selected for the following examples for the purpose of clarity and using a single, cohesive set of terminology.

[0080] Fig. 4 depicts a 5G telecommunications system roaming architecture with local breakout with service-based interfaces with the control plane. N32401 is, in current standards, a TLS-protected bi-directional interface between a visiting security edge protection proxy (vSEPP) 402 in a visiting public land mobile network (VPLMN) 403 and a home SEPP (hSEPP) 404 in a home PLMN (HPLMN) 405. In embodiments of the system 100, security proxy functions 102 are deployed to enhance the hSEPP and vSEPP for smooth introduction and crypto-agile management of inter-PLMN communications over the N32 interface 401.

[0081] Fig. 5 is a schematic overview of a non-roaming service-based 5G reference architecture. The reference architecture comprises a series of network functions or network services, which may be conceptualized as logical components of the network. Each function or service may be implemented on hardware in a physical network node, spread over a plurality of network nodes in the network, or virtualized.The non-roaming 5G architecture comprises a network slice selection function (NSSF) 501 and a corresponding interface / reference point NnsSf 502. The nonroaming 5G architecture comprises a network slice-specific authentication and authorization function (NSSAAF) 503 and a corresponding interface Nnssaaf 504. The non-roaming 5G architecture comprises a network exposure function (NEF) 505 and a corresponding interface Nnef 506. The non-roaming 5G architecture comprises an authentication server function (ALISF) 507 and a corresponding interface NauSf 508. The non-roaming 5G architecture comprises a network function repository function (NRF) 509 and a corresponding interface Nnrf 510. The non-roaming 5G architecture comprises an access and mobility management function (AMF) 511 and a corresponding interface Namf 512.

[0082] The AMF 511 further interacts with a user equipment (UE) 513 over an N1 interface 514 and the radio access network (RAN) 515 over an N2 interface 516.

[0083] The non-roaming 5G architecture comprises a policy control function (PCF) 517 and a corresponding interface NpCf 518. The non-roaming 5G architecture comprises a session management function (SMF) 519 and a corresponding interface NSmf 520. The SMF further interacts with a user plane function (UPF) 521 over the N4 interface 522. The UPF 521 further interacts with the RAN 515 over an N3 interface 523, with itself over an N9 interface 524, and with a data network (DN) 525 over an N6 interface 526.

[0084] The non-roaming 5G architecture comprises a unified data management (UDM) 527 and a corresponding interface NUdm 528. The non-roaming 5G architecture comprises a service communication proxy (SCP) 529 and a corresponding interface Nscp530. The non-roaming 5G architecture comprises an application function (AF) 531 and a corresponding interface Naf 532.

[0085] Each of these interfaces enables network-critical communication which must be protected to ensure secure transmission of data. Security proxy functions 102 can be deployed in each network function to protect the network, such as for example by deploying a first security proxy function in the SCP 529 and a second security proxy function in the NRF 509 to provide secure communication between the SCP 529 and the NRF 509. The security level between each pair of network functions may thus be adjusted by the security proxy functions deployed at each function to the preciselevel required considering the sensitivity of the data handled and any specific regulatory requirements.

[0086] Fig. 6 is a schematic overview of a geographically distributed network function 601 in the network 200, where the network function is implemented in a first network node 602 and a second network node 603. The network node 602 and the network node 603 communicate over an interface 604 protected with TLS in the current standard. Deploying security proxy functions 102a, 102b into network node 602 and network node 603 respectively allows for flexibility in the security of the communication interface 604 which may be adapted depending on changing requirements, but also on-the-fly if the distribution of tasks between the nodes changes. For example, the network node 602 can be live and network node 603 can be on active stand-by, ready to support network node 602 with e.g. computations if needed. The demands on the first network node may drop drastically enough that the second network node can go to sleep, into a passive stand-by, at which point the security level of the interface 604 can change. Then, if the computational demands on the first network node 602 increase, the first network node can transmit a message to the second network node 603 to wake up, at which point the security level of the interface may increase to support more sensitive communications between them so the nodes can be kept synchronized. The increase in the security level between network node 602 and network node 603 is supported by security proxy functions 102a, 102b in the respective network nodes 602, 603.

[0087] Fig. 7 is a schematic overview of communications at the network edge, where security proxy functions 102 may be deployed to protect e2e communication among fixed and mobile end user devices. Fig. 7 depicts a server 701 hosting a 5G core network. The server 701 is in communication with a 5G radio access network 702 comprising a plurality of radio access nodes 703a, 703b. The radio access nodes 703a, 703b provide access to routers 704a, 704b, 704c enabling each router to create a wireless local area network (WLAN) serving a set of end devices such as smart devices 705a, 706a, 707a, mobile phones 705b, 706b, 707b, and smart vehicles 705c, 706c, 707c. Deploying a security proxy function 102 in the core network 701 , each router 704a, 704b, 704c, and each endpoint device 705a, 705b, 705c, 706a, 706b, 706c, 707a, 707b, 707c enables the devices in each WLAN to communicate securely e2e. In embodiments where the endpoint device has acomputational power too limited to support a security proxy function 102, the security proxy function in the router may instead assist in establishing the e2e secure channel. The security level is adapted for each type of communication: for example a low level of security for communication related to streaming an exercise video, and much higher level of security for communication related to a medical smart device or a banking application on a smartphone. The security proxy function can in such embodiments operate at the application level, tailoring the security level to the precise demands of the precise use case, where the demands may be set in advance by e.g. the application provider or on the fly by the security orchestration function 101 using for example a machine learning algorithm to determine an appropriate security level.

Claims

CLAIMS1. A computer-implemented system (100) for a communications network (200), the system (100) comprising:a security orchestration function (101), the security orchestration function configured to manage a plurality of security proxy functions (102), the security orchestration function further configured to interoperate with a network management function and a network security management function;the plurality of security proxy functions (102) hosting security capabilities on behalf of network services and / or applications; anda service exposure application programming interface, API, (103), the service exposure API configured to abstract network capabilities between the security orchestration function (101) and network data consumers.

2. The system (100) according to claim 1 , wherein the plurality of security proxy functions (102) embed libraries implementing cryptographic algorithms.

3. The system (100) according to any one of claims 1 or 2, wherein the security orchestration function (101) is configured to expose a network security infrastructure to network data consumers via the service exposure API (103).

4. The system (100) according to any one of claims 1-3, wherein the plurality of security proxy functions (102) are configured to expose North-Bound Interfaces, NBI, to interoperate with network management and orchestration entities of the network (200).

5. The system (100) according to any one of claims 1-4, wherein the plurality of security proxy functions (102) are configured to change a cryptographic algorithm in use by a network consumer immediately on receipt of a request from the security orchestration function (101) via the NBI.

6. The system (100) according to any one of claims 1-5, wherein the plurality of security proxy functions (102) are configured to use embedded security capabilities together with external equipments and services exposed through the network (200), wherein the external equipments and services comprise one or more of: a quantum random number generator, quantum key distribution, and entanglement distribution services.

7. The system (100) according to any one of claims 1-6, wherein the security orchestration function (101) performs lifecycle management for the plurality of security proxy functions.

8. The system (100) according to any one of claims 1-7, wherein the security orchestration function (101) is configured to, jointly with the network management function of the network (200), instantiate secure connections between pairs of security proxy functions (102).

9. The system (100) according to claim 8, wherein the security orchestration function (101) is configured to instantiate secure connections between pairs of security proxy functions on demand from a communication service provider or consumer or automatically triggered by detection of a changed security context.

10. The system (100) according to any one of claims 1-9, wherein the security orchestration function (101) implements one or more machine learning functions to assist with one or more of: monitoring of the network infrastructure; selection of security levels; network vulnerability assessment.

11. The system (100) according to any one of claims 1 -10, wherein the security proxy functions are deployed for one or more of the following tasks:to support inter-public land mobile network, inter-PLMN, connectivity;to support intra-PLMN connectivity;to support intra-network function connectivity; orto support end-to-end communication at the network edge.

12. A network apparatus comprising a memory and a processor, the network apparatus configured to implement a system (100) for a communications network (200), the system (100) comprising:a security orchestration function (101), the security orchestration function configured to manage a plurality of security proxy functions (102), the security orchestration function further configured to interoperate with a network management function and a network security management function;the plurality of security proxy functions (102) hosting security capabilities on behalf of network services and / or applications; anda service exposure application programming interface, API, (103), the service exposure API configured to abstract network capabilities between the security orchestration function and network data consumers.

13. The network apparatus according to claim 12, further configured to implement the system (100) according to any one of claims 2-11.

14. A computer program comprising computer-readable instructions which, when executed by the processor of a network apparatus, cause the network apparatus to implement a system (100) according to any one of claims 1-11.

15. A computer program product comprising a computer program according to claim 14.

Images