5G Network Slice Zero Trust Verification With Blockchain State Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security technologies, particularly in 5G networks, fail to provide sufficient protection against attacks, especially control flow attacks and attack vectors, and do not effectively monitor and secure virtual network function (VNF) instances or slices, leading to potential vulnerabilities and performance degradation.
Innovation Solution
Implementing a zero trust security framework using an Adaptive Security Controller (ASC) and Distributed Ledger Technology (DLT) to verify and monitor devices, assign VNF instances, and manage network slices through smart contracts, ensuring continuous authentication and least-privilege access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If layer 7 applications are deployed to improve network security, then protection against attacks is enhanced, but system performance significantly degrades due to kernel modifications
Solution Approach 1:
The patent introduces a kernel module as an intermediary component that operates between the kernel and user space, allowing security monitoring and attack detection without requiring modifications to layer 7 applications. This intermediary approach enables security functions to be implemented at a lower level where they can operate efficiently without degrading application performance.
Solution Approach 2:
The patent replaces the traditional mechanical approach of modifying layer 7 applications with a systematic kernel-level monitoring mechanism. Instead of altering application code structure, the system uses kernel hooks and system call interception to monitor and detect attacks, substituting the need for application-level modifications with a more efficient kernel-based approach.
2Reliability
If kernel modification is performed to implement security technologies, then security monitoring capability is improved, but system stability deteriorates and warranties are voided
Solution Approach 1:
The patent segments security monitoring functions into distinct kernel modules that can be independently loaded and unloaded. This segmentation allows security capabilities to be added without modifying the core kernel structure, maintaining system stability while enabling comprehensive security monitoring through modular components.
3Ease of operation
If traditional security technologies are used, then implementation simplicity is maintained, but control flow attacks and attack vectors are not captured
Solution Approach 1:
The patent implements feedback mechanisms through system call interception and monitoring, where each system call is analyzed and fed back to the security module for attack detection. This continuous feedback loop enables the system to detect control flow attacks and other malicious activities while maintaining a relatively simple implementation through standardized kernel interfaces.
4Loss of information
If monitoring tools are deployed to track attacks, then attack visibility is improved, but data obfuscation capability is reduced
Solution Approach 1:
The patent applies local quality by implementing selective monitoring and obfuscation - critical security-relevant data is monitored and analyzed in detail, while less sensitive data maintains its obfuscation. This localized approach allows the system to achieve comprehensive attack visibility for security-critical information while preserving obfuscation capabilities for other data types.
Data Source
AI summary
Methods and systems are provided for assigning one or more Virtual Network Function (VNF) instances, or slices, to devices, and for monitoring each change of state associated with the slices. Embodiments include applying an Advanced Security Control (ASC) protocol to verify devices for each request for access to a slice, to establish a zero trust measurement with respect to a network, such as a 5G network. In embodiments, a blockchain is associated with each slice and stored in a distributed ledger, for example to allow rapid access to network slice and device information if a slice will be re-instantiated.