5G Network Slicing for Secure Remote Access to IoT Endpoints
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in securely and efficiently enabling remote access to IoT devices due to the potential security risks and operational overhead in configuring VPN connections for numerous external clients, especially in industrial IoT networks.
Innovation Solution
The implementation of 5G network slicing and user plane functions to create a dedicated network slice for secure remote access, using a virtual private network tunnel between the client and endpoint, facilitated by a secure remote access function (SRAF) within the 5G cellular architecture.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional VPN connections are configured for each external client to access IoT devices, then remote access capability is improved, but device complexity and operational overhead increase significantly
Solution Approach 1:
The patent segments the network into multiple network slices, with dedicated slices for different types of traffic (e.g., remote access traffic, industrial control traffic). This segmentation allows remote access functionality to be isolated in specific slices, reducing the complexity burden on the entire network and enabling independent configuration and management of remote access without affecting other critical functions.
Solution Approach 2:
The patent introduces a network slice as an intermediary layer between external clients and IoT devices. Instead of directly configuring VPN connections to individual devices, the remote access function is provided through a dedicated network slice that acts as a mediator, simplifying the configuration process and reducing operational overhead while maintaining secure access capabilities.
2Adaptability or versatility
If unfettered Internet access is allowed on endpoint devices, then remote access flexibility is improved, but security risks increase due to potential malicious attacks
Solution Approach 1:
The patent applies segmentation by creating separate network slices for different traffic types. Remote access traffic is isolated in dedicated slices with specific security policies, while critical industrial control traffic remains in isolated slices with restricted access. This segmentation enables flexible remote access without exposing the entire network to security risks, as malicious traffic is contained within specific slices.
Solution Approach 2:
The patent implements local quality by applying different security characteristics to different network slices. Each slice can have customized security policies, access controls, and protection mechanisms tailored to its specific traffic type. This allows high flexibility for remote access slices while maintaining stringent security for critical control slices, thereby achieving both adaptability and security.
3Adaptability or versatility
If multiple external clients are granted access to IoT devices, then service capability is improved, but security exposure and attack surface increase
Solution Approach 1:
The patent segments external client access into different network slices, allowing multiple clients to access services through isolated channels. Each client or client group can be assigned to specific slices with appropriate access permissions, enabling enhanced service capability while limiting security exposure. If one slice is compromised, the isolation prevents lateral movement to other slices, maintaining overall system reliability.
4Reliability
If dedicated network slices are created for specific traffic types, then security and efficiency are improved, but network complexity increases
Solution Approach 1:
The patent implements universality by creating a standardized network slice framework that can serve multiple functions. The same network slice infrastructure supports various traffic types (remote access, industrial control, data transmission) through configurable policies and rules. This multi-functional approach allows dedicated slices to provide enhanced security and efficiency while reducing overall network complexity through reuse of common components and standardized management procedures.
Data Source
AI summary
In one embodiment, a device receives a request from a client to remotely access an endpoint in a local network. The device instantiates a network slice having a remote access function in a cellular network. The device causes the endpoint to communicate a particular type of traffic via the network slice and the remote access function. The device configures a virtual private network tunnel between the client and the remote access function. The client and endpoint communicate with one another via a connection that comprises the network slice and the virtual private network tunnel.