Network Slice Management Data Access for Tenant Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods fail to control the range of management data access for tenants in a network slice, leading to potential data isolation issues and security breaches.
Innovation Solution
A method and apparatus that enable a tenant to obtain management data within a proper range by using network slice service identifiers to determine and filter management data access, ensuring data isolation and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If management data is opened to tenants based on service requirements, then tenants can learn network slice running status and develop their own business, but there is no good method to control the tenant to obtain management data within a reasonable range
Solution Approach 1:
The patent segments management data access control by introducing a tenant identifier and network slice service identifier to divide and control which specific management data each tenant can access. This segmentation approach allows tenants to obtain only the management data relevant to their subscribed network slice services, preventing access to unauthorized data while maintaining systematic control.
Solution Approach 2:
The patent applies local quality by making different tenants have different access permissions to different management data based on their subscribed network slice services. Each tenant receives customized data access rights corresponding to their specific service requirements, rather than providing uniform access to all tenants.
2Loss of information
If tenants can access management data, then they can monitor network slice running status, but data isolation between different tenants is not properly implemented
Solution Approach 1:
The patent introduces an intermediary mechanism (the first network element and identifier matching system) that mediates between tenants and management data. This intermediary verifies tenant identifiers and network slice service identifiers to determine which management data each tenant is authorized to access, thereby implementing data isolation while facilitating authorized access.
Solution Approach 2:
The patent implements feedback by having the first network element determine whether a tenant has permission to obtain management data of a managed object instance based on the tenant identifier and network slice service identifier. This feedback mechanism ensures tenants receive only authorized data while maintaining proper isolation.
Data Source
AI summary
A method and apparatus for obtaining management data, where the method includes: a first network element receiving a request message from a second network element, where the request message indicates a tenant identifier and at least one managed object instance, where the tenant identifier corresponds to at least one network slice service identifier; the first network element determining a first managed object instance in the at least one managed object instance based on the network slice service identifier, where the second network element has permission to obtain management data in the first managed object instance; and the first network element obtaining management data corresponding to the network slice service identifier from the first managed object instance.