WO2018054220A1

WO2018054220A1 - Slice network security isolation method and device

Info

Publication number: WO2018054220A1
Application number: PCT/CN2017/100757
Authority: WO
Inventors: 谢振华
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-09-20
Filing date: 2017-09-06
Publication date: 2018-03-29
Also published as: CN107846275A

Abstract

Disclosed are a slice network security isolation method and device. The method comprises: a first control plane function (CPF) sends a slice network security policy to a terminal, the slice network security policy being used for generating a key set associated with the terminal and a slice network, and the slice network being indicated by information in the slice network security policy.

Description

Method and device for slice network security isolation

Technical field

The present application relates to, but is not limited to, the field of communications, and in particular, to a method and apparatus for security isolation of a slice network.

Background technique

The 3rd Generation Partnership Project (3GPP) proposes a scheme of network slicing, so that one physical mobile network can be virtualized into multiple virtual mobile networks, and each virtual mobile network is called a slicing network ( Slice). The terminal can access multiple different slicing networks to obtain corresponding services, which greatly increases the flexibility of the network.

The security isolation of the slicing network can isolate the network side from each other, but does not consider the factors of the terminal accessing the network. The method for the terminal to access the physical mobile network and its slicing network is as shown in FIG. 1 . The process of the method includes the following steps:

Step 101: The terminal sends an attach network request to the mobile network, for example, sending an Attach Request message, carrying the user identifier and the slice network selection information for selecting the access network of the terminal, and attaching the network request to the wireless access network. (Radio Access Network, RAN) forwarded to the appropriate Control Plan Function (CPF);

Step 102: The CPF interacts with the terminal to perform an authentication and key negotiation process. For example, the CPF sends a User Authentication Request message to the terminal, and the terminal responds to the User Authentication Response message.

Step 103: The CPF interacts with the terminal to perform a network security activation process. For example, the CPF sends a Secure Mode Command message to the terminal, and the terminal responds to the Secure Mode Complete message. The parameters passed between the terminal and the CPF and the parameters passed in the step 102 are used as key generation parameters (how to generate the definition, only need to input different generation parameters), and generate various keys, such as an integrity key. And confidentiality keys, which can be used to provide integrity and confidentiality protection for messages and data;

Step 104: The CPF selects a slice network that the terminal can access according to the slice network selection information.

Step 105: The CPF sends an attach network accept message, such as an Attach Accept message, to the terminal through the RAN, and carries the new user identifier and the slice network selection information.

To this end, the terminal can securely access the functional entities in each slice network using the network security context (ie, various keys and other auxiliary information generated in steps 102 and 103).

Summary of invention

The following is an overview of the topics detailed in this document. This Summary is not intended to limit the scope of the claims.

In the above manner, the terminal can only use the related information to generate a set of keys for accessing the physical mobile network and all its slicing networks, so that when the key of the terminal accessing a slice network is leaked, the key can be used to access other keys. The slicing network and the physical mobile network result in no real security isolation between the slice networks and between the slice network and the physical mobile network.

Embodiments of the present invention provide a method and apparatus for security isolation of a slice network.

This application provides:

A method for slicing network security isolation, comprising:

The first control plane function entity CPF sends a slice network security policy to the terminal, the slice network security policy is used to generate a key set related to the terminal and the slice network, wherein the slice network is used by the slice network security policy Information indication.

A device for slicing network security isolation, comprising:

a first sending unit, configured to send a slice network security policy to the terminal, where the slice network security policy is used to generate a key set related to the terminal and the slice network, wherein the slice network is used by the slice network security policy Information indication.

An apparatus for slicing network security isolation, comprising: a processor and a memory; the memory being configured to store a program for slice network security isolation, the processor being configured to read the security isolation for a slice network The program does the following:

Sending a slice network security policy to the terminal, where the slice network security policy is used to generate and A set of keys associated with a terminal and a slice network, wherein the slice network is indicated by information in the slice network security policy.

A method for slicing network security isolation, comprising:

The first control plane function entity CPF receives key information from the second CPF;

Transmitting, by the first CPF, a slice network security policy to a terminal, where the slice network security policy is used to generate a key set related to the terminal and a slice network, where the slice network is used by information in the slice network security policy Instructions.

A device for slicing network security isolation, comprising:

a first receiving unit, configured to receive key information from the second CPF;

a second sending unit, configured to send a slice network security policy to the terminal, where the slice network security policy is used to generate a key set related to the terminal and the slice network, wherein the slice network is secure by the slice network Information indication in the policy.

A key negotiation method for a slice network, comprising: receiving, by a terminal, a slice network security policy from a first CPF, where the slice network security policy is used to generate a key set related to a slice network, wherein the slice network is The information indication in the slice network security policy.

An apparatus for slicing network key agreement, comprising: a second receiving unit configured to receive a slice network security policy from a first CPF, the slice network security policy to generate a key set related to a slice network, Wherein the slice network is indicated by information in the slice network security policy.

An apparatus for slicing network key agreement, comprising: a processor and a memory; the memory being configured to store a program for slice network key negotiation, the processor being configured to read the slice network secret The key negotiation procedure performs the following operations:

A slice network security policy is received from the first CPF, the slice network security policy for generating a set of keys associated with the slice network, wherein the slice network is indicated by information in the slice network security policy.

On the other hand, the embodiment of the present application further provides a computer readable storage medium storing computer executable instructions, which are implemented when the computer executable instructions are executed.

On the other hand, the embodiment of the present application further provides a computer readable storage medium, where computer executable instructions are stored, and when the computer executable instructions are executed, the key negotiation method of the slice network is implemented.

A slice network key negotiation method and device, and a slice network security isolation method and device provided by the embodiment of the present invention, the network side sends a slice network security policy to a terminal, where the slice network security policy is used to generate the terminal and the slice a network-related set of keys, wherein the slice network is indicated by information in the slice network security policy, the slice network security policy may include derived information or key length information related to the slice network such that the network side and the terminal The dedicated key can be generated for different slice networks, so that each slice network has a dedicated security protection means, which realizes the security isolation between the slice networks and improves the security of the slice network communication.

Other aspects will be apparent upon reading and understanding the drawings and detailed description.

BRIEF abstract

FIG. 1 is a schematic flowchart of a slice network key generation;

2 is a schematic flowchart of a method for security isolation of a slice network according to an embodiment of the present invention;

3 is a schematic structural diagram of a device for simulating network security isolation according to an embodiment of the present invention;

4 is a schematic flowchart of a method for security isolation of a slice network according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a device for security isolation of a slice network according to an embodiment of the present invention; FIG.

FIG. 6 is a schematic structural diagram of another apparatus for slicing network key agreement according to an embodiment of the present invention;

FIG. 7 is a schematic flowchart of a security isolation of a slice network according to an embodiment of the present invention;

FIG. 8 is a schematic flowchart of another method for security isolation of a slice network according to an embodiment of the present invention.

Detailed

Embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

The steps illustrated in the flowchart of the figures may be executed in a computer system such as a set of computer executable instructions. Also, although logical sequences are shown in the flowcharts, in some cases the steps shown or described may be performed in a different order than the ones described herein.

As shown in FIG. 2, the present application provides a method for segmenting network security isolation, including:

Step 201: The first control plane function entity CPF sends a slice network security policy to the terminal, where the slice network security policy is used to generate a key set related to the terminal and the slice network, where the slice network is secure by the slice network Information indication in the policy.

The information of the slice network security policy may be used to indicate the information of the slice network, that is, the slice network security policy may be used according to the information in the slice network security policy. Determine the corresponding slice network.

In some implementations, the slice network security policy includes derived information or key length information associated with the slice network.

In some implementations, the derived information includes an indication or a derived parameter specifying whether the key is derived.

In some implementations, before step 201, the method further includes: step 200, the first CPF sending key information to the second CPF, and receiving the slice network security policy from the second CPF.

As shown in FIG. 3, the present application provides a device for security isolation of a slice network, which is applied to a first control plane functional entity CPF, including:

The first sending unit 31 is configured to send a slice network security policy to the terminal, where the slice network security policy is used to generate a key set related to the terminal and the slice network, wherein the slice network is configured by the slice network security policy Information indication in .

In some implementations, the method further includes: a first obtaining unit 32, configured to send key information to the second CPF, and receive the slice network security policy from the second CPF.

Correspondingly, the present application further provides a device for slice network security isolation, which is applied to A CPF, comprising: a processor and a memory; the memory being configured to store a program for slice network security isolation, the processor being configured to read the program for slice network security isolation to perform the following operations: to a terminal A slice network security policy is sent, the slice network security policy for generating a set of keys associated with the terminal and the slice network, wherein the slice network is indicated by information in the slice network security policy.

In this application, the network side sends a slice network security policy to the terminal, where the slice network security policy is used to generate a key set related to the terminal and the slice network, where the slice network is used by the slice network security policy The information indicates that the slice network security policy may contain derived information or key length information associated with the slice network. In this way, the network side and the terminal can respectively generate their own dedicated keys for different slice networks, so that each slice network has a dedicated security protection means, which realizes the security isolation between the slice networks and improves the slice network communication. safety.

As shown in FIG. 4, the present application further provides a method for segmenting network security isolation, including:

Step 401: The first CPF receives key information from the second CPF.

Step 402: The first CPF sends a slice network security policy to the terminal, where the slice network security policy is used to generate a key set related to the terminal and the slice network, where the slice network is configured by the slice network security policy Information indication in .

In an implementation manner, the first CPF sends the slice network security policy to the terminal by using the second CPF.

Correspondingly, as shown in FIG. 5, the present application further provides an apparatus for slicing network key agreement, which is applied to a first control plane function entity CPF, including:

The first receiving unit 51 is configured to receive key information from the second CPF;

a second sending unit 52, configured to send a slice network security policy to the terminal, where the slice network security policy is used to generate a key set related to the terminal and the slice network, wherein the slice network is configured by the slice network Information indication in the security policy.

In an implementation manner, the second sending unit 52 may be configured to send the slice network security policy to the terminal by using the second CPF.

Correspondingly, the present application further provides an apparatus for slicing network key agreement, which is applied to A CPF comprising: a processor and a memory; the memory being arranged to store a program for slicing network key agreement, the processor being arranged to read the program for slice network key agreement to perform the following operations: The first CPF receives key information from the second CPF; the first CPF sends a slice network security policy to the terminal, where the slice network security policy is used to generate a key set related to the terminal and the slice network, where The slicing network is indicated by information in the slicing network security policy.

In this application, after receiving the key information from the second CPF, the network side sends the slice network security policy to the terminal by using the second CPF, where the slice network security policy is used to generate the terminal and the slice network. A set of keys, wherein the slice network is indicated by information in the slice network security policy, the slice network security policy may include derived information or key length information associated with the slice network. In this way, the network side and the terminal can respectively generate their own dedicated keys for different slice networks, so that each slice network has a dedicated security protection means, which realizes the security isolation between the slice networks and improves the slice network communication. safety.

The present application further provides a key negotiation method applied to a slice network on a terminal side, which may include: receiving, by a terminal, a slice network security policy from a first CPF, where the slice network security policy is used to generate a key related to a slice network A set, wherein the slice network is indicated by information in the slice network security policy.

In one implementation, the slice network security policy includes derived information or key length information associated with the slice network.

In one implementation, the derived information includes an indication or a derived parameter specifying whether the key is derived.

Correspondingly, as shown in FIG. 6, the present application further provides an apparatus for slice network key negotiation applied to a terminal, including:

a second receiving unit, configured to receive a slice network security policy from the first CPF, the slice network security policy to generate a key set related to the slice network, wherein the slice network is in the slice network security policy Information indication.

Correspondingly, there is also provided a device for slicing network key agreement, applied to a terminal, comprising: a processor and a memory; the memory being configured to store a process for slicing network key agreement In sequence, the processor is configured to read the program for slice network key negotiation to perform the following operations:

In the present application, the terminal receives a slice network security policy from the network side, the slice network security policy is used to generate a key set related to the slice network, wherein the slice network is indicated by information in the slice network security policy The slice network security policy may include derivative information or key length information related to the slice network, so that the network side and the terminal can generate their own dedicated keys for different slice networks, respectively, so that each slice network has and is dedicated The security protection means realizes the security isolation between the slice networks and improves the security of the slice network communication.

FIG. 7 is a flowchart of a security key isolation of a slice network according to an embodiment of the present invention, where the process includes:

Step 701: The terminal sends an attach network request to the mobile network, for example, sends an Attach Request t message, and the message is forwarded to the CPF through the radio access network (RAN);

The attached network request message may carry a user identifier, a slice network selection information, and the like. In practical applications, the user identifier may be an International Mobile Subscriber Identity (IMSI) or a temporary user identifier assigned by the network. The slice network selection information may be used to assist the network side to select a slice network accessible by the terminal.

Step 702: Perform an authentication and key agreement process between the CPF and the terminal.

The mutual authentication may be implemented by performing an authentication and key agreement (AKA), for example, the CPF sends a User Authentication Request message to the terminal, and the terminal responds to the User Authentication Response. ) message.

Step 703: Perform a network security activation process between the CPF and the terminal.

For example, the network security activation process may include: the CPF sends a Secure Mode Command message to the terminal, and the terminal completes the response to the CPF security mode (Secure) Mode Complete) message.

In the network security activation process, the parameters passed by the process and the parameters passed in the step 702 are used as key generation parameters between the terminal and the CPF (how to generate the generated parameters, only different input parameters are input), and various types are generated. Keys, such as integrity keys and confidentiality keys, that can be used to provide integrity and confidentiality protection for messages and data.

Step 704: The CPF selects a slice network that the terminal can access.

In practical applications, the CPF may select an accessible slice network for the terminal according to the slice network selection information. The slice networks indicated in the slice network selection information are not necessarily all selected.

Step 705: The CPF sends an attach network accept message to the terminal through the RAN, for example, sending an Attach Accept message, and the attach network accept message carries a new user identifier (such as a new temporary user identifier allocated by the CPF for the terminal) and a slice network. Select the information and also carry the slice network security policy. A slice network security policy is used to generate a set of keys associated with the terminal and the slice network, wherein the slice network is indicated by information in the slice network security policy, and the slice network security policy includes derived information or key length information related to the slice network, etc. .

The derived information includes an indication or a derived parameter of whether the specified key is derived, or carries a corresponding derived algorithm identifier.

The following is an example of the usage of a slice network security policy:

Each key in the network security context may have a corresponding key identifier, and the key in the security context in the slice network and the key in the network security context may correspond to each other.

A. The derivation indication corresponding to a certain key of a certain slice network is “Yes”, then the generation of the key is calculated by a key generation algorithm, and the algorithm uses a corresponding key in the network security context, and the corresponding slice network of the slice Select the information as a parameter. If there is a corresponding derived algorithm identifier, the corresponding derived algorithm is used instead of the pre-defined derivative algorithm;

B. A certain key of a certain slice network corresponds to a derived parameter (there may be no derivative indication). When the key identifier is used as the derived parameter, the key generation algorithm of the key is in the network security context and the key identifier is Corresponding key, corresponding slice network selection information of the slice as a parameter, when other information is used as a derivative parameter, the key generation algorithm of the key takes the corresponding key in the network security context, and the derived parameter is used as a parameter . Two types of derived parameters are available At the same time;

C. A key of a certain slice network corresponds to a key length, and the key is a value obtained by intercepting the corresponding length in the network security context. If A and B are combined, the key is The result calculated by the key generation algorithm intercepts the value after the corresponding length.

The above implementation manner may also be: Step 703 after step 704, and carrying the slice network security policy in the security mode command message in step 703.

In this embodiment, if the terminal accesses a certain slice network, it has the capability to determine how to generate a security context related to the slice network according to the corresponding information in the slice network security policy, so that different slice networks may have different security contexts. The real isolation between the sliced networks.

FIG. 8 is a flowchart of another slice network security isolation in an embodiment of the present invention, where the process includes:

Step 801, the terminal sends an attach network request to the mobile network, for example, sends an Attach Request message, and the attach network request message is forwarded to the CPF1 through the radio access network (RAN);

The attached network request message may carry a user identifier, a slice network selection information, and the like. In an actual application, the user identifier may be an International Mobile Subscriber Identity (IMSI) or a temporary user identifier allocated by a network. The slice network selection information may be used to assist the network side to select a slice network accessible by the terminal.

Step 802: Perform an authentication and key agreement process between the CPF1 and the terminal.

Step 803: Perform a network security activation process between the CPF1 and the terminal.

In the network security activation process, the parameters passed by the process and the parameters passed in the step 802 are used as key generation parameters between the terminal and the CPF 1 (how to generate the generated parameters, only different input parameters are input), and various types are generated. Keys, such as integrity keys and confidentiality keys, that can be used to provide integrity and confidentiality protection for messages and data.

Step 804: The CPF1 determines, according to the information in the attach request, that the CPF2 is more suitable for processing the attach request, and then sends a forward attach network request to the CPF2, for example, sends a Forward Attach Request message, where the message carries a set of keys. The key is from the key in CPF1 for the terminal, and these keys are generated by CPF1 according to the information transmitted in step 802 or step 803;

Step 805: The CPF2 selects a slice network that the terminal can access for the terminal.

Step 806: The CPF2 sends a forwarding attachment network to the CPF1, for example, sends a Forward Attach Accept message, where the message carries a new user identifier (such as a new temporary user identifier assigned by the CPF2) and a slice network selection information. , also carries a slice network security policy;

The slice network security policy refers to the description in step 705 in FIG.

Step 807: The CPF1 sends an attach network accept message to the terminal through the RAN, and carries the slice network security policy obtained in step 806.

Another embodiment of the present embodiment is that step 803 is after step 805, and step 803 is performed by CPF2, and the slice network security policy is carried in the security mode command message in step 803.

In addition, the embodiment of the present application further provides a computer readable storage medium storing computer executable instructions, which are implemented when the computer executable instructions are executed.

In addition, the embodiment of the present application further provides a computer readable storage medium, where computer executable instructions are stored, and when the computer executable instructions are executed, the key negotiation method of the slice network is implemented.

The computer readable storage medium may include, but is not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk. The medium in which the program code is stored.

In this embodiment, the processor executes the method steps of the above embodiments in accordance with program code already stored in the storage medium.

For examples in this embodiment, reference may be made to the examples described in the foregoing embodiments and implementation manners, and details are not described herein again.

One of ordinary skill in the art will appreciate that all or a portion of the above steps may be performed by a program to instruct related hardware, such as a processor, which may be stored in a computer readable storage medium, such as a read only memory, disk or optical disk. Wait. All or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the above embodiment may be implemented in the form of hardware, for example, by implementing an integrated circuit to implement its corresponding function, or may be implemented in the form of a software function module, for example, executing a program stored in the memory by a processor. / instruction to achieve its corresponding function. This application is not limited to any combination of the specified forms of hardware and software.

The basic principles and main features of the present application and the advantages of the present application are shown and described above. The present application is not limited by the above-described embodiments, and the above-described embodiments and the description are only for explaining the principles of the present application, and various changes and modifications may be made to the present application without departing from the spirit and scope of the application. And improvements are within the scope of the claimed invention.

Claims

A method for slicing network security isolation, comprising:

The first control plane function entity CPF sends a slice network security policy to the terminal, the slice network security policy is used to generate a key set related to the terminal and the slice network, wherein the slice network is used by the slice network security policy Information indication.
The method of claim 1 wherein

The slice network security policy includes derived information or key length information associated with the slice network.
The method of claim 2, wherein

The derived information includes an indication or a derived parameter specifying whether the key is derived.
The method of claim 1, wherein before the first CPF sends the slice network security policy to the terminal, the method further includes:

The first CPF sends key information to the second CPF and receives the slice network security policy from the second CPF.
A device for slicing network security isolation, comprising:

a first sending unit, configured to send a slice network security policy to the terminal, where the slice network security policy is used to generate a key set related to the terminal and the slice network, wherein the slice network is used by the slice network security policy Information indication.
The apparatus of claim 5 further comprising:

The first obtaining unit is configured to send key information to the second CPF, and receive the slice network security policy from the second CPF.
An apparatus for slicing network security isolation, comprising: a processor and a memory; the memory being configured to store a program for slice network security isolation, the processor being configured to read the security isolation for a slice network The program does the following:

A slice network security policy is sent to the terminal, the slice network security policy for generating a set of keys associated with the terminal and the slice network, wherein the slice network is indicated by information in the slice network security policy.
A method for slicing network security isolation, comprising:

The first control plane function entity CPF receives key information from the second CPF;

Transmitting, by the first CPF, a slice network security policy to a terminal, where the slice network security policy is used to generate a key set related to the terminal and a slice network, where the slice network is used by information in the slice network security policy Instructions.
The method of claim 8 wherein

The first CPF sends the slice network security policy to the terminal by using the second CPF.
A device for slicing network security isolation, comprising:

a first receiving unit, configured to receive key information from the second CPF;

a second sending unit, configured to send a slice network security policy to the terminal, where the slice network security policy is used to generate a key set related to the terminal and the slice network, wherein the slice network is secure by the slice network Information indication in the policy.
A key negotiation method for a slice network, comprising:

The terminal receives a slice network security policy from the first CPF, the slice network security policy for generating a set of keys associated with the slice network, wherein the slice network is indicated by information in the slice network security policy.
The method of claim 7 wherein

The slice network security policy includes derived information or key length information associated with the slice network.
The method of claim 8 wherein

The derived information includes an indication or a derived parameter specifying whether the key is derived.
An apparatus for slicing network key agreement, comprising:

a second receiving unit, configured to receive a slice network security policy from the first CPF, the slice network security policy to generate a key set related to the slice network, wherein the slice network is in the slice network security policy Information indication.
An apparatus for slicing network key agreement, comprising: a processor and a memory; The memory is arranged to store a program for slicing network key agreement, the processor being arranged to read the program for slice network key agreement to perform the following operations:

A slice network security policy is received from the first CPF, the slice network security policy for generating a set of keys associated with the slice network, wherein the slice network is indicated by information in the slice network security policy.
A computer readable storage medium storing computer executable instructions for performing the method of slice network security isolation of any of claims 1-4.
A computer readable storage medium storing computer executable instructions for performing the method of slice network security isolation of any of claims 8-9.
A computer readable storage medium storing computer executable instructions for performing a key agreement method of a slice network of any of claims 11-13.