WO2021022764A1

WO2021022764A1 - Network slicing method and network slicing apparatus for 5g core network

Info

Publication number: WO2021022764A1
Application number: PCT/CN2019/127743
Authority: WO
Inventors: 吕东; 周远长; 苏国章
Original assignee: 广州爱浦路网络技术有限公司
Priority date: 2019-08-08
Filing date: 2019-12-24
Publication date: 2021-02-11
Also published as: CN110401946A

Abstract

Disclosed are a network slicing method for a 5G core network and a network slicing apparatus for the 5G core network. The method comprises: performing network slicing on a 5G core network so as to obtain network slicing network elements for network slicing; and setting a security protection level Si for network slicing, wherein i is an integer; and according to the security protection level Si, presetting the network slicing network elements for network slicing to an environment corresponding to the security protection level Si. The method proposed by the present invention supports the implementation of independent users using a logically independent core network system on the 5GC core network side in an Internet of Things or vertical industry environment, and the core network elements of customer groups of the Internet of Things and vertical industry and the core network elements of ordinary users are logically independent from each other to meet various demands for different types of users with regards to network delay, bandwidth, the number of connections, security levels, and application environment customization.

Description

Network slicing method and network slicing device of 5G core network

Technical field

The invention relates to the field of wireless communication, in particular to a network slicing method and a network slicing device of a 5G core network.

Background technique

The overall deployment of the 5G core network (hereinafter referred to as: 5GC) is based on the public cloud platform NFV/SDN (Virtualization and Software Defined Networking) environment. Figure 1 shows the overall block diagram of the 5GC. In this model mode, the security protection needs of users in the multi-level Internet of Things and vertical industries (private networks) cannot be met, including the security of 5GC itself signaling and the security of UE user data plane data transmitted on 5GC.

Under the framework of 5G wireless network communication, the network slicing function for IoT and vertical industry (private network) purposes is not proposed in the 3GPP specifications. The Internet of Things or vertical industry (private network) users are not proposed to slice the core network. Yuan has a corresponding definition of network security protection.

In addition, in the submitted patent applications, such as CN107580360A (a method, equipment and network architecture for network slice selection), CN108495358A (a method for network slice selection based on NFV), and CN108566289A (based on 5G mobile communication network slice architecture design management Method) Among the various 5GC network slicing patent solutions proposed, only the implementation method of 5GC network slicing is proposed, but the security protection method required for network slicing is not mentioned.

Summary of the invention

The present invention provides a network slicing method and a network slicing device for a 5G core network to solve the problems raised in the background art.

In the first aspect, a network slicing method for a 5G core network is provided, and the method includes:

Perform network slicing on the 5G core network to obtain network sliced network elements;

Set the security protection level Si for the network slice, where i is an integer; and

According to the security protection level Si, preset the network slice network elements of the network slice to an environment corresponding to the security protection level Si.

According to a specific implementation of the embodiment of the present disclosure, the network slice network element includes at least one of the following network slice network elements: AMF, SMF, UDM, AUSF, PCF, and AUSF.

According to a specific implementation of the embodiment of the present disclosure, the 5G core network is provided with a slice network security policy controller SPCF, and the slice network security policy controller SPCF is configured to set the security protection level Si of the network slice.

According to a specific implementation of the embodiment of the present disclosure, the security protection level Si is defined as follows:

Si = {isolated_Level, inf_Audit, Mrg_Audit, content_DPI,...}; where,

isolated_Level represents the degree of security isolation, and its value indicates the isolation level of the deployment platform on which the network slice runs;

inf_Audit represents the network interface, and its value indicates the security audit of each network interface;

Mrg_Audit represents the management interface, and its value indicates the security audit of each management interface;

content_DPI represents the external network interface, and its value indicates the DPI deep packet analysis of user data.

According to a specific implementation of the embodiment of the present disclosure, the security isolation level isolated_Level={public_cloud, pravited_cloud, hardware_isolated}; where

public_cloud means that each network element of the 5G core network is completely deployed in a shared cloud;

pravited_cloud means that each network element of the 5G core network is deployed in an independent network environment;

hardware_isolated indicates that each network element of the 5G core network is deployed in physical isolation.

According to a specific implementation of the embodiment of the present disclosure, the network interface inf_Audit={N1, N2, N3, N4, N5, N6, N7, N8, N9}; where

The N1, N2, N3, N4, N5, N7, N8 interfaces are internal network interfaces of the 5G core network; and

The N6 and N9 interfaces are the external network interfaces in the 5G core network for external communication.

According to a specific implementation of the embodiment of the present disclosure, the management interface Mrg_Audit={Mgr_AMF, Mgr_SMF, Mgr_UDM, Mgr_PCF, Mgr_UPF}; where,

Mgr_AMF represents the AMF network element management interface;

Mgr_SMF represents SMF network element management interface;

Mgr_UDM represents the UDM network element management interface;

Mgr_PCF represents the PCF network element management interface; and

Mgr_UPF represents UPF network element management interface.

According to a specific implementation of the embodiment of the present disclosure, the external network interface content_DPI={N6_DPI, N9_DPI}, where N6_DPI represents the external network interface N6, and N9_DPI represents the external network interface N9.

According to a specific implementation of the embodiment of the present disclosure, the Si={S1, S2, S3, S4, S5}, and

In S1, isolated_Level=hardware_isolated, inf_Audit={N1=1, N2=1, N3=1, N4=1, N5=1, N6=1, N7=1, N8=1, N9=1}, Mrg_Audit= {Mgr_AMF=0, Mgr_SMF=0, Mgr_UDM=1, Mgr_PCF=1, Mgr_UPF=0}, content_DPI={N6_DPI=1, N9_DPI=1};

In S2, isolated_Level={hardware_isolated}, inf_Audit={N1=0, N2=0, N3=0, N4=0, N5=0, N6=1, N7=0, N8=0, N9=1}, Mrg_Audit = {Mgr_AMF = 1, Mgr_SMF = 1, Mgr_UDM = 1, Mgr_PCF = 1, Mgr_UPF = 1}, content_DPI = {N6_DPI = 1, N9_DPI = 0},

In S3, isolated_Level={prvated_cloud}, inf_Audit={N1=0, N2=0, N3=0, N4=0, N5=0, N6=1, N7=0, N8=0, N9=1}, Mrg_Audit={Mgr_AMF=1, Mgr_SMF=1, Mgr_UDM=1, Mgr_PCF=1, Mgr_UPF=1}, content_DPI={N6_DPI=1, N9_DPI=1},

In S4, isolated_Level={prvated_cloud}, inf_Audit={N1=0, N2=0, N3=0, N4=0, N5=0, N6=1, N7=0, N8=0, N9=1}, Mrg_Audit={Mgr_AMF=1, Mgr_SMF=1, Mgr_UDM=1, Mgr_PCF=1, Mgr_UPF=1}, content_DPI={N6_DPI=1, N9_DPI=0},

In S5, isolated_Level={public_cloud}, inf_Audit={N1=0, N2=0, N3=0, N4=0, N5=0, N6=1, N7=0, N8=0, N9=1}, Mrg_Audit={Mgr_AMF=1, Mgr_SMF=1, Mgr_UDM=1, Mgr_PCF=1, Mgr_UPF=1}, content_DPI={N6_DPI=1, N9_DPI=0}.

In a second aspect, a network slicing device for a 5G core network is provided, and the device includes:

The network slicing module is configured to perform network slicing on the 5G core network to obtain network slicing network elements of the network slicing;

The security protection level setting module is configured to set the security protection level Si for the network slice, where i is an integer; and

The preset module is configured to preset the network slice network elements of the network slice to an environment corresponding to the security protection level Si according to the security protection level Si.

The network slicing scheme of the 5G core network according to the embodiment of the present disclosure includes: performing network slicing on the 5G core network to obtain network slicing network elements of the network slicing; setting a security protection level Si for the network slicing, where i is an integer; and The security protection level Si is to preset the network slicing network elements of the network slice to an environment corresponding to the security protection level Si. The method proposed by the present invention supports the realization of independent users on the 5GC core network side to use a logically independent core network system under the environment of the Internet of Things or vertical industry, and integrates the core network elements of the Internet of Things and vertical industry customer groups with ordinary users. In terms of logic independence, it meets the various needs of different types of users for network delay, bandwidth, number of connections, security level, and application environment customization.

Description of the drawings

In order to explain the technical solutions of the embodiments of the present disclosure more clearly, the following will briefly introduce the drawings that need to be used in the embodiments. Obviously, the drawings in the following description are only some embodiments of the present disclosure. For those of ordinary skill in the art, other drawings can be obtained from these drawings without creative work.

Figure 1 shows the system framework of the 5G core network;

2 shows a diagram of an example environment of a network slicing security architecture according to an embodiment of the present disclosure;

Fig. 3 shows a flow chart of constructing a secure environment for an end user UE according to an embodiment of the present disclosure;

Fig. 4 shows a block diagram of a 5G core network network slicing device according to an embodiment of the present disclosure; and

Figure 5 shows an example architecture of a 5G core network slicing network security environment.

detailed description

The embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

The following describes the implementation of the present disclosure through specific specific examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and the features in the embodiments can be combined with each other if there is no conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of the present disclosure.

It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be obvious that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and/or function described herein are only illustrative. Based on the present disclosure, those skilled in the art should understand that one aspect described herein can be implemented independently of any other aspects, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement devices and/or methods of practice. In addition, other structures and/or functionalities other than one or more of the aspects set forth herein may be used to implement this device and/or practice this method.

It should also be noted that the illustrations provided in the following embodiments merely illustrate the basic idea of the present disclosure in a schematic manner. The figures only show the components related to the present disclosure rather than the number, shape, and shape of the components in actual implementation. For size drawing, the type, quantity, and ratio of each component can be changed at will during actual implementation, and the component layout type may also be more complicated.

In addition, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, those skilled in the art will understand that the described aspects may be practiced without these specific details.

Under the 5GC system architecture, the system will slice the core network resources according to the needs of users (similar to deploying independent network element equipment) to meet the needs of the corresponding set of customer groups, and the purpose is to meet similar IoT and various types of The needs of private network user groups.

With the development of NFV/SDN, especially the maturity of virtualized network technology, it provides very convenient conditions for the core network to be multi-instantiated on a unified platform. In the new specification, the 5G core network has newly added the function of network slicing, providing independent core network elements in logical domains for user groups with different types of requirements.

In the 5G network, when a user enters the network and starts to register, 5GC will perform network slice distribution to the users who are connected to the system after passing the authentication. The term "network slice" refers to the implementation of network data similar to traffic The essence of management offload management is to logically divide the actual physical network into multiple different types of virtual networks, according to the service requirements of different users, such as delay, bandwidth, reliability, etc. Indicators are used to divide, so as to deal with complex and changeable application scenarios.

For the method of distributing network slices to connected users, refer to CN107580360A (a method, equipment and network architecture for network slice selection) and CN108495358A (a method for network slice selection based on NFV). The contents of these patents are incorporated by reference. Here.

In the embodiment of the present disclosure, when a terminal user enters the network and divides network slices into it, according to the 5GC network slice network element security protection level requirement Si, the security protection level Si is input as a necessary option parameter. According to the level of Si, Preset the network slicing network elements (AMF/SMF/UDM/UPF/PCF/AUSF) in the software, hardware, and network environments required by different security levels.

Fig. 2 shows a diagram of an example environment of a network slicing security architecture according to an embodiment of the present disclosure. As shown in FIG. 2, in the embodiment of the present disclosure, the corresponding security protection level Si is set for the network slices divided by the end users who enter the network, so that the corresponding network slice network elements are preset to correspond to the security protection level Si Environment.

Specifically, the network slicing network element may include access and mobility management function AMF, session management function SMF, unified data management UDM, user platform function UPF, policy control function PCF, and authentication server function AUSF. It should be understood that although in the embodiments of the present disclosure, AMF/SMF/UDM/UPF/PCF/AUSF is used as an example of network slicing network elements for description, the present disclosure is not limited to this, but may include other network slicing networks. yuan.

Specifically, a sliced network security policy controller SPCF as an example of a security protection level setting module (processing unit) can be set in the 5G network. The SPCF is used to generate the Si level defined according to the embodiment of the present disclosure. Si can be { S1, S2, S3, S4, S5, ... Sn}, that is, SPCF can be used to define n security protection levels, where n is an integer.

In this way, when the system allocates network slices to end users, and 5GC core network slices are operated, according to the security protection level (requirements) input by the end user UE, the network slice network elements allocated to the end user UE are preset to different Software, hardware, network and other environments.

Fig. 3 shows a flowchart of constructing a secure environment for an end user UE according to an embodiment of the present disclosure. As shown in Figure 3, building a secure environment for the end user UE includes:

S301: Set the 5G core network slice security protection level Si.

S302: Construct a 5G core network slicing security environment.

In the embodiment of the present disclosure, the end user UE can set the 5G core network slice security protection level Si through the set slice network security policy controller SPCF. Si can be specifically S1, S2, S3, S4, S5, ... Sn one of.

In the embodiment of the present disclosure, the safety protection level Si is defined as a set R. Then Si=R{S1, S2, S3, S4, S5...Sn}, and the safety protection level Si increases from low to high as i increases.

According to a specific implementation of the embodiment of the present disclosure, five security protection levels S1/S2/S3/S4/S5 are defined, but in actual applications, it can be dynamically expanded according to requirements.

In addition, the definition of the security protection level Si is as follows: Si={isolated_Level, inf_Audit, Mrg_Audit, content_DPI,...}. It should be understood that although in the embodiments of the present disclosure, the element of Si includes isolated_Level, inf_Audit, Mrg_Audit, and content_DPI, the present invention is not limited to this. The element of Si may also include other elements, that is, according to the Other factors besides content_DPI determine the safety protection level Si.

isolated_Level represents the degree of security isolation, a security level defined for the network slicing security environment of the 5G core network. Its value indicates the isolation level of the deployment platform on which the network slicing runs; inf_Audit represents the core network interface, and its value indicates the security of each network interface Audit; Mrg_Audit represents the management interface, and its value represents the audit of the network management interface; content_DPI represents the external network interface, and its value indicates the DPI deep packet analysis of user data.

Specifically, the security isolation level isolated_Level={public_cloud, pravited_cloud, hardware_isolated}, where public_cloud has the lowest security, and each network element of the 5G core network is completely in the common cloud, which may be attacked by public safety network security due to the security of the cloud. Pravited_cloud is relatively safer than public_cloud. When deployed in an independent network environment, it is only different from the public cloud where it is deployed, and it may still receive public network security attacks. The relative probability is lower than that of public cloud. hardware_isolated indicates the use of physical isolation deployment, the highest level of security protection. For the values of public_cloud, pravited_cloud, and hardware_isolated, OFF=0, which means enabled, and NO=1, which means not enabled.

It should be understood that although in the embodiment of the present disclosure, the elements of isolated_Level include public_cloud, pravited_cloud, and hardware_isolated, the present invention is not limited to this, but may also include other security isolation levels. In other words, the isolated_Level element can contain any security isolation degree.

The network interface inf_Audit represents each interface in the 5GC network, and its value represents the security audit of each interface.

Specifically, the network interface inf_Audit={N1, N2, N3, N4, N5, N6, N7, N8, N9}. In the 5G core network, the N1, N2, N3, N4, N5, N7, and N8 interfaces are the internal network interfaces of the 5G core network, and the N6 and N9 interfaces are the external network interfaces in the 5G core network for external communication. At that time, stricter auditing is required. For the value of N1-N9, OFF=0, which means no audit, and NO=1, which means audit.

It should be understood that although in the embodiment of the present disclosure, the element of inf_Audit includes N1, N2, N3, N4, N5, N6, N7, N8, N9, the present invention is not limited to this, but may also include other network interfaces. In other words, the element of inf_Audit can contain any network interface.

The network management interface Mrg_Audit represents the 5GC network element management interface, and its value represents the audit of each management interface.

Specifically, the network management interface Mrg_Audit={Mgr_AMF, Mgr_SMF, Mgr_UDM, Mgr_PCF, Mgr_UPF}, for its value, OFF=0, which means no audit, and NO=1, which means audit.

It should be understood that although in the embodiments of the present disclosure, the elements of Mrg_Audit include Mgr_AMF, Mgr_SMF, Mgr_UDM, Mgr_PCF, and Mgr_UPF, the present invention is not limited to this, but may also include other network management interfaces. In other words, the element of Mrg_Audit can contain any network management interface.

content_DPI represents the content depth data packet of the external network interface, and its value represents the audit of the data packet. Among the 5G core network elements, the UPF network element is an external interface for user data, and performs deep data packet analysis on the content of the UPF's N6/N9 network interface. Specifically, content_DPI={N6_DPI, N9_DPI}, for its value, OFF=0, which means no audit, and NO=1, which means audit.

It should be understood that although in the embodiments of the present disclosure, the elements of content_DPI include N6_DPI and N9_DPI}, the present invention is not limited to this, but may also include other external network interface content depth data packets. In other words, the content_DPI element can contain any external network interface content depth data packet.

Above, the meaning of each parameter in the protection level Si has been defined. In the embodiment of the present disclosure, five safety protection levels S1/S2/S3/S4/S5 are also specifically defined. It should be clear that in actual applications, it can be dynamically expanded according to requirements. In addition, define the elements in Si as follows: isolated_Level={public_cloud, pravited_cloud, hardware_isolated}, inf_Audit={N1, N2, N3, N4, N5, N6, N7, N8, N9}, Mrg_Audit={Mgr_AMF, Mgr_SMF, Mgr_UDM, Mgr_PCF, Mgr_UPF} and content_DPI={N6_DPI, N9_DPI}. However, it should be understood that the sub-elements included in these elements may not be limited to those shown above, but may include other sub-elements.

(1) S1: Autonomous security protection.

The user's slice network environment is complete, physically isolated from other 5GC network slices, using physical isolation deployment (hardware_isolated). The open network interface N2/N3 communicates with (R)AN, the open network interface N6 communicates with the user’s application server Appserver, (R)AN and Appserver and the 5GC network slice require the same level of S1 security security environment, And N2/N3/N6 interface has authentication and safety protection. N1/N4/N5/N7/N8/N9 are not developed externally, and are only used inside the 5GC network slice.

The S1 security level is the highest level of security protection in 5GC network slices. The user's slice network is completely the same as other users of this level. Users who access this 5GC slice network are required to obtain full authorization and complete trust. The visitor is required to be a user of the S1 level of the system, and the visiting user is also an operating entity in the environment, in the same security instance environment. Under the S1 security level, user data integrity is fully guaranteed.

The S1 security level is sliced in the 5GC network. The management and application server that is required to be connected to it is a fully trusted device, and has the same physical isolation security protection level. The management interface audit of the network element can be closed.

Under the S1 security level, the values of the elements in Si are set as follows:

Deployment platform:

isolated_Level={hardware_isolated}

Under the S1 security protection level, the operating deployment platform requires security and stability, and the hardware isolation level is adopted.

Network Interface:

inf_Audit={N1=1, N2=1, N3=1, N4=1, N5=1, N6=1, N7=1, N8=1, N9=1}; (OFF=0, means no audit, NO =1, means audit, the same below).

The network interface is the interface between 5GC internal network elements and external network elements. Under the S1 security protection level, security review is required to be enabled. The N6/N9 network interface is connected to the outside world, and the security audit function must be enabled.

Management interface:

Mrg_Audit={Mgr_AMF=0, Mgr_SMF=0, Mgr_UDM=1, Mgr_PCF=1, Mgr_UPF=0};

Under the S1 level, the management interface of 5GC network elements, AMF/SMF/UPF management interface, does not control user behavior, and has low security requirements. PCF/UPF has user behavior control and requires security audits before the user can perform Login operation user account opening, account cancellation, Qos, billing and other data.

External network interface:

content_DPI={N6_DPI=1, N9_DPI=1};

Under the S1 security protection level, the external network interface N6/N9 must perform DPI deep packet analysis on user data to prevent users from unsafe behavior.

(2) S2: System audit protection

The user's slice network environment is complete, physically isolated from other 5GC network slices, using physical isolation deployment (hardware_isolated). Audit part of the network interface, management network interface, and external network interface N6 audit.

Specifically, under the S2 security level, the value of each element in Si is set as follows:

Deployment platform:

isolated_Level={hardware_isolated}

Under the S2 security protection level, the operating deployment platform requires security and stability, and the hardware isolation level is adopted.

Network Interface:

inf_Audit={N1=0, N2=0, N3=0, N4=0, N5=0, N6=1, N7=0, N8=0, N9=1};

The network interface is the interface between the 5GC internal network element and the external network element. Under the S2 security protection level, the internal network interface does not enable security auditing. The N6/N9 network interface is connected to the outside world, and the security audit function must be enabled.

Management interface:

Mrg_Audit={Mgr_AMF=1, Mgr_SMF=1, Mgr_UDM=1, Mgr_PCF=1, Mgr_UPF=1};

Under the S2 level, the management interface of 5GC network elements, AMF/SMF/UPF management interface, does not control user behavior, and has low security requirements. PCF/UPF has user behavior control and requires security audits before the user can perform Login operation user account opening, account cancellation, Qos, billing and other data.

External network interface:

content_DPI={N6_DPI=1, N9_DPI=0};

Under the S2 security protection level, the external network interface N6 performs DPI deep packet analysis on user data to prevent users from unsafe behavior. The N9 interface is a roaming data interface from internal or external. It receives data from the local network. It has GTP tunnel encapsulation, which can remove the DPI user deep packet analysis function.

(3) S3: Security mark protection

The user's slice network environment is complete, and it does not need to be physically isolated from other 5GC network slices, and uses private cloud deployment (private_cloud). Audit part of the network interface, management network interface, and external network interface N6 audit.

Specifically, under the S3 security level, the value of each element in Si is set as follows

Deployment platform:

isolated_Level={prvated_cloud}

Under the S3 security protection level, marking protection is required for the running deployment platform, and private cloud level deployment is adopted.

Network Interface:

inf_Audit={N1=0, N2=0, N3=0, N4=0, N5=0, N6=1, N7=0, N8=0, N9=1};

Management interface:

Mrg_Audit={Mgr_AMF=1, Mgr_SMF=1, Mgr_UDM=1, Mgr_PCF=1, Mgr_UPF=1};

Under the S3 level, in the private cloud environment of the system deployment, the management interface of the 5GC network element requires a security audit before the user can log in.

External network interface:

content_DPI={N6_DPI=1, N9_DPI=1};

Under the S3 security protection level, the external network interface N6/N9 performs DPI deep packet analysis on user data to prevent users from unsafe behavior.

(4) S4: Structured protection

Specifically, under the S4 security level, the value of each element in Si is set as follows

Deployment platform:

isolated_Level={prvated_cloud}

Under the S4 security protection level, marking protection is required for the running deployment platform, and private cloud level deployment is adopted.

Network Interface:

inf_Audit={N1=0, N2=0, N3=0, N4=0, N5=0, N6=1, N7=0, N8=0, N9=1};

The network interface is the interface between the 5GC internal network element and the external network element. Under the S3 security protection level, the internal network interface does not enable security auditing. The N6/N9 network interface is connected to the outside world, and the security audit function must be enabled.

Management interface:

Mrg_Audit={Mgr_AMF=1, Mgr_SMF=1, Mgr_UDM=1, Mgr_PCF=1, Mgr_UPF=1};

In the S4 level, 5GC network elements are deployed in a private cloud environment, and their management interfaces require security audits before users can log in.

External network interface:

content_DPI={N6_DPI=1, N9_DPI=0};

Under the S4 security protection level, the external network interface N6/N9 user data performs DPI deep packet analysis to prevent users from unsafe behavior. The N9 interface comes from an internal or external roaming data interface, and it receives data from the local network. It has a GTP tunnel encapsulation, which can remove the DPI user deep packet analysis function.

(5) S5: Access verification protection

The user's slice network environment is complete, and it does not need to be physically isolated from other 5GC network slices, and uses public cloud deployment (public_cloud). There is no DPI deep packet inspection for some network interface audits, management network interfaces, and external network interfaces.

Specifically, under the S5 security level, the value of each element in Si is set as follows

Deployment platform:

isolated_Level={public_cloud}

Under the S5 security protection level, marking protection is required for the running deployment platform, and private cloud level deployment is adopted.

Network Interface:

inf_Audit={N1=0, N2=0, N3=0, N4=0, N5=0, N6=1, N7=0, N8=0, N9=1};

Management interface:

Mrg_Audit={Mgr_AMF=1, Mgr_SMF=1, Mgr_UDM=1, Mgr_PCF=1, Mgr_UPF=1};

At the S5 level, 5GC network elements are deployed in a shared cloud environment, and their management interfaces require security audits before users can log in.

External network interface:

content_DPI={N6_DPI=1, N9_DPI=0};

Under the S5 security protection level, the external network interface N6/N9 user data is subjected to DPI deep packet analysis to prevent users from unsafe behavior. The N9 interface is a roaming data interface from internal or external. It receives data from the local network. It has GTP tunnel encapsulation, which can remove the DPI user deep packet analysis function.

Above, the embodiments of the present disclosure are described with five security protection levels S1-S5, but the present disclosure is not limited to this, but more or less security protection levels may be used.

Referring to Fig. 4, an embodiment of the present disclosure also provides a 5G core network network slicing device 400 corresponding to the foregoing method embodiment, and the device includes:

The network slicing module 401 is configured to perform network slicing on the 5G core network to obtain network slicing network elements of the network slice;

The security protection level setting module 402 is configured to set a security protection level Si for the network slice, where i is an integer; and

The presetting module 403 is configured to preset the network slice network elements of the network slice to an environment corresponding to the security protection level Si according to the security protection level Si.

Since the various modules and functions of the network slicing device of the 5G core network have been described with reference to the method embodiments, they will not be repeated here.

The network slicing method and device of the 5G core network according to the embodiments of the present disclosure support the realization of independent users on the 5GC core network side to use a logically independent core network system in the Internet of Things or vertical industry environments, and integrate the Internet of Things and vertical industry customers The core network elements of the group and ordinary users are logically independent to meet the various needs of different types of users for network delay, bandwidth, number of connections, security level, and application environment customization.

Specifically, in the embodiment of the present disclosure, when the terminal user UE enters the network, when the 5GC network slicing operation is performed on the terminal user UE, the security policy controller SPCF unit that sets the network slicing is added to receive the Sn security input by the user. The protection level is to obtain the security policy of each network slice and construct a security environment instance for it to protect the security of the newly generated network elements in the network slice, construct a security barrier, and provide protection for the safe operation of the 5GC system.

The 5GC core network allocates different 5GC core network slice resources according to the slicing requirements of the terminal user UE when the end user UE enters the network through the default (initial) slice. When allocating core network slicing resources to the UE, a slicing policy security controller unit, namely: slicing policy security controller SFCF, is added according to the method of the embodiment of the present disclosure, which provides the end user UE with a security level protection Si interface API to meet various requirements. This kind of terminal user UE's requirements for the insecure protection level of 5G core network slices. When allocating network slice resources to the UE, a security instance environment with different security protection levels is constructed according to the Si level to protect the network elements of the network slice.

In the embodiments of the present disclosure, five basic security protection levels, such as S1/S2/S3/S4/S5, are defined to meet the current 5GC network slicing requirements for different levels of network security protection levels for various users.

The definition of Si security protection level is based on the basic cloud and hardware platform deployed by 5GC network elements, 5GC network element network interface, 5GC network management interface, and 5GC external network interface security requirements, and 5 levels of security protection level configuration are proposed.

As shown in Figure 5, after the terminal user UE of the 5G network performs UE access authentication communication with the public (default) network slice of 5GC through gNB, according to the UE's demand for network slice, choose to allocate or enter the corresponding 5GC core In the network slicing network. For the selection of network slices, please refer to the patent: CN107580360A, a method, equipment and network architecture for network slice selection, CN108495358A, a network slice selection method based on NFV, CN108566289A, a design management method based on 5G mobile communication network slice architecture, these The entire content of the patent is incorporated herein by reference.

In the embodiment of the present disclosure, when 501 submits an application for 5GC network slicing requirements, 502 submits a security protection level Si to the slicing policy security controller SPCF according to the UE end user, and requires that the environment of 5GC network slicing provides a corresponding Si-level network Security level requirements.

When 503 provides 5GC network slice allocation to UE terminal users, according to the function of the slice strategy security controller SPCF provided by this solution, output the security protection level Si strategy that meets the UE terminal user's security protection level Si strategy, and hand it over to 504 to establish the corresponding dedicated 5GC slice network security Environmental examples.

504 According to the security protection level Si strategy, according to the Si level definition, the 5GC network slicing resources (AMF/SMF/UDM/PCF/UPF) allocated to the current UE end users are constructed to construct the corresponding level of security protection environment instance. It is used to protect the security of UE terminal users.

According to the method of the embodiment of the present disclosure, when the terminal user UE enters the 5GC, after the network slice is allocated to it, the 5GC slice network service network element provided for it is allocated according to the security protection level Si requirements of the UE terminal user The corresponding basic network security example of security protection requirements will effectively protect UE end users’ requirements for basic network security in the 5GC slice network, and also protect the safety of 5GC slice network instances in different vertical industries (private networks). Different requirements.

In addition, the embodiments of the present disclosure define five basic 5GC network slice security levels based on general network security requirements, which can also be dynamically expanded according to specific application environment requirements.

In addition, the embodiments of the present disclosure define network interface security audit, management interface security audit, external network interface DPI deep packet inspection, external network interface DPI, etc. based on the characteristics of the 5GC network slice network element AMF/SMF/UDM/PCRF/UPF. It satisfies the security audit of the internal and external interfaces of the 5GC network slicing and the deep data packet analysis function of the data message.

In the 5GC core network, a complete security protection is provided independently for a single network element AMF/SMF/UDM/UPF/PCF, which can also achieve the purpose of security protection, but attacks such as DDOS attacks and network congestion cannot be well protected because It is an independent network element protection. In the embodiment of the present disclosure, the entire 5GC core network element can be protected, and a good 5GC single network element can be protected.

This solution proposes to combine the 5GC network slicing with the basic network element security protection of the mobile communication core network, especially the network elements after 5GC network slicing, the security itself and the audit of the network interface, management interface, and external network interface Function, as well as external interface DPI function and security protection combined. Especially the 5GC network slicing network elements, according to the new specification, all run on the cloud platform. This will bring major security risks to 5GC network slicing. The method proposed in this solution effectively meets the security protection of 5GC network slicing at all levels. The customers who requested it solved the user's requirements for safety very well.

The method of the embodiment of the present disclosure combines the security challenges faced by the 5GC slicing network with the protection needs of users, and will effectively solve the security problem of the 5GC network slicing and maintain the security and stability of the network.

For those skilled in the art, it is obvious that the present invention is not limited to the details of the above exemplary embodiments, and the present invention can be implemented in other specific forms without departing from the spirit or basic characteristics of the present invention. Therefore, from any point of view, the embodiments should be regarded as exemplary and non-limiting. The scope of the present invention is defined by the appended claims rather than the above description, and therefore it is intended to fall within the claims. All changes within the meaning and scope of the equivalent elements of are included in the present invention.

In addition, it should be understood that although this specification is described in accordance with the implementation manners, not each implementation manner only contains an independent technical solution. This narration in the specification is only for clarity, and those skilled in the art should regard the specification as a whole The technical solutions in each embodiment can also be appropriately combined to form other implementations that can be understood by those skilled in the art.

Claims

A network slicing method for a 5G core network, characterized in that the method includes:

Perform network slicing on the 5G core network to obtain network sliced network elements;

Set the security protection level Si for the network slice, where i is an integer; and

According to the security protection level Si, preset the network slice network elements of the network slice to an environment corresponding to the security protection level Si.
The 5G core network network slicing method according to claim 1, wherein the network slicing network element comprises at least one of the following network slicing network elements: AMF, SMF, UDM, AUSF, PCF, and AUSF.
The network slicing method based on the 5G core network according to claim 1 or 2, wherein the 5G core network is provided with a slice network security policy controller SPCF, and the slice network security policy controller SPCF is configured to set The security protection level of network slicing is Si.
The 5G core network network slicing method according to claim 3, wherein the definition of the security protection level Si is as follows:

Si = {isolated_Level, inf_Audit, Mrg_Audit, content_DPI,...}; where,

isolated_Level represents the degree of security isolation, and its value indicates the isolation level of the deployment platform on which the network slice runs;

inf_Audit represents the network interface, and its value indicates the security audit of each network interface;

Mrg_Audit represents the management interface, and its value indicates the security audit of each management interface;

content_DPI represents the external network interface, and its value indicates the DPI deep packet analysis of user data.
The 5G core network network slicing method according to claim 4, wherein the security isolation level isolated_Level={public_cloud, pravited_cloud, hardware_isolated}; wherein

public_cloud means that each network element of the 5G core network is completely deployed in a shared cloud;

pravited_cloud means that each network element of the 5G core network is deployed in an independent network environment;

hardware_isolated indicates that each network element of the 5G core network is deployed in physical isolation.
The network slicing method based on 5G core network according to claim 5, wherein the network interface inf_Audit={N1, N2, N3, N4, N5, N6, N7, N8, N9}; wherein

The N1, N2, N3, N4, N5, N7, N8 interfaces are internal network interfaces of the 5G core network; and

The N6 and N9 interfaces are the external network interfaces in the 5G core network for external communication.
The 5G core network network slicing method according to claim 6, wherein the management interface Mrg_Audit={Mgr_AMF, Mgr_SMF, Mgr_UDM, Mgr_PCF, Mgr_UPF}; wherein,

Mgr_AMF represents the AMF network element management interface;

Mgr_SMF represents SMF network element management interface;

Mgr_UDM represents the UDM network element management interface;

Mgr_PCF represents the PCF network element management interface; and

Mgr_UPF represents UPF network element management interface.
The method for network slicing of the 5G core network according to claim 7, wherein the external network interface content_DPI={N6_DPI, N9_DPI}, wherein N6_DPI represents the external network interface N6, and N9_DPI represents the external network interface N9.
The network slicing method for a 5G core network according to claim 8, wherein the Si={S1, S2, S3, S4, S5}, and

In S1, isolated_Level=hardware_isolated, inf_Audit={N1=1, N2=1, N3=1, N4=1, N5=1, N6=1, N7=1, N8=1, N9=1}, Mrg_Audit= {Mgr_AMF=0, Mgr_SMF=0, Mgr_UDM=1, Mgr_PCF=1, Mgr_UPF=0}, content_DPI={N6_DPI=1, N9_DPI=1};

In S2, isolated_Level={hardware_isolated}, inf_Audit={N1=0, N2=0, N3=0, N4=0, N5=0, N6=1, N7=0, N8=0, N9=1}, Mrg_Audit={Mgr_AMF=1, Mgr_SMF=1, Mgr_UDM=1, Mgr_PCF=1, Mgr_UPF=1}, content_DPI={N6_DPI=1, N9_DPI=0},

In S3, isolated_Level={prvated_cloud}, inf_Audit={N1=0, N2=0, N3=0, N4=0, N5=0, N6=1, N7=0, N8=0, N9=1}, Mrg_Audit={Mgr_AMF=1, Mgr_SMF=1, Mgr_UDM=1, Mgr_PCF=1, Mgr_UPF=1}, content_DPI={N6_DPI=1, N9_DPI=1},

In S4, isolated_Level={prvated_cloud}, inf_Audit={N1=0, N2=0, N3=0, N4=0, N5=0, N6=1, N7=0, N8=0, N9=1}, Mrg_Audit={Mgr_AMF=1, Mgr_SMF=1, Mgr_UDM=1, Mgr_PCF=1, Mgr_UPF=1}, content_DPI={N6_DPI=1, N9_DPI=0},

In S5, isolated_Level={public_cloud}, inf_Audit={N1=0, N2=0, N3=0, N4=0, N5=0, N6=1, N7=0, N8=0, N9=1}, Mrg_Audit={Mgr_AMF=1, Mgr_SMF=1, Mgr_UDM=1, Mgr_PCF=1, Mgr_UPF=1}, content_DPI={N6_DPI=1, N9_DPI=0}.
A network slicing device for a 5G core network, characterized in that the device includes:

The network slicing module is configured to perform network slicing on the 5G core network to obtain network slicing network elements of the network slicing;

The security protection level setting module is configured to set the security protection level Si for the network slice, where i is an integer; and

The preset module is configured to preset the network slice network elements of the network slice to an environment corresponding to the security protection level Si according to the security protection level Si.