Alcatel Lucent

Nokia Technologies Oy

Nokia Solutions and Networks Oy

Alcatel

Zhigang Luo

Zhiyuan Hu

Xueqiang Yan

Jing Ping

Duan Chen

Yueming Yin

Tao Yang

Mingli You

Wen Wei

Ning Lu

Wei Zhang

Wei Guan

Iris Adam

Mingyu Zhao

Lina Wang

Xueqing Zhu

Ping Huang

Yan Mei Zhang

Pingping Wen

Stephane Mahieu

Zhikun Wan

Hongbao Zhang

Dunlop Li Po

Wei Li

Yan Zhang

Provided herein are systems and methods for preventing network attacks in a network slice. In particular, security requirements of a network slice instance are retrieved and specific security policies to be applied to each of multiple constituent network slice subnet instances within the network slice instance are identified based on the security requirements. A deployment of one or more security function instances for each subnet instance configured according to a corresponding security policy is then facilitated.

Method and apparatus for preventing network attacks in a network slice

An example method may include receiving slice isolation policy for a network slice subnet (NSS) in a transport network (TN) domain, mapping the slice isolation policy to network resource isolation policy and traffic isolation policy, and mapping the network resource isolation policy and the traffic isolation policy to network resource allocation policy and data traffic forward policy, respectively. The network resource allocation policy and the data traffic forward policy may be applied in creation of the TN NSS.

Method and apparatus for isolation support in network slicing

Embodiments of the present disclosure relate to devices, methods, apparatuses and computer readable storage media for data sharing. In example embodiments, a method for data sharing is provided. The method comprises, in response to receiving a first request to share data of a user from a data sharing agent, creating a data sharing smart contract for the user. The method further comprises publishing the data sharing smart contract to one or more data consumers. The method further comprises, in response to receiving a second request to access the data from a data consumer, generating, by executing the data sharing smart contract, an indication that the data consumer is authorized to access the data. In addition, the method further comprises sending the indication to the data consumer. In this way, end users are enabled to manage and share their personal data by themselves.

Data sharing

Embodiments of the present disclosure relate to methods, devices and computer readable storage medium for tracing an attack source in a service function chain overlay network. In example embodiments, a request for tracing an attack source of an attacking data is sent at the attack tracer to a first service function chain domain of a plurality of service function chain domains through which the attacking data flow passes subsequently. The request includes flow characteristics of the attacking data flow. Then, the attack tracer receives a first set of results of flow matching based on the flow characteristics from the first service function chain domain. The attack tracer identifies the attack source in the plurality of service function chain domains at least in part based on the first set of results. In this way, the attack source may be traced efficiently in the service function chain overlay network.

Attack source tracing in SFC overlay network

A method for isolation in the CN domain of a network slice includes receiving a slice isolation policy and establishing a CN NSS isolation policy based on the slice isolation policy. When the CN NSS isolation policy includes a network resource isolation policy, the network resource isolation policy is mapped to a network resource allocation policy, a part of which relating to physical resources is sent to a network function management function (NFMF) and a part relating to virtual resources is sent to a network function virtualization management and orchestration function. When the NSS isolation policy includes an application level isolation policy, the application level isolation policy is mapped to an application level policy which is sent to the NFMF.

Method and apparatus for fine-grained isolation in CN NSS domain of E2E network slice

Embodiments of the disclosure provide a method, device and computer readable medium for protecting MAC addresses. According to embodiments of the present disclosure, the terminal device may obtain a set of virtual MAC addressed from a network device and may connect with a further network device (for example, Wi-Fi AP or Bluetooth devices) using the virtual MAC addresses. In this way, tracking the terminal device with MAC address is prevented so that user privacy protection could be enhanced.

Methods, device and computer-readable medium for protecting MAC addresses

Example embodiments of the present disclosure relate to enablement of a service function chain based on a software defined network. In some embodiments, there is provided a method implemented at a service function chain controller. The method comprises creating a service function chain for a packet, the service function chain comprising a set of ordered service functions that are to process the packet; and configuring respective forwarding rules associated with the service function chain directly or indirectly to a plurality of network nodes in a software defined network, the respective forwarding rules indicating how the plurality of network nodes forward the packet to the set of ordered service functions in the service function chain. In this way, it is possible to enable the service function chain in the software defined network.

Implementation of service function chain on basis of software-defined network

A set of raw data relating to activity of one or more users in accordance with a communication network is obtained. The communication network is managed by a network operator. The obtained set of raw data is processed in accordance with at least one data isolation policy maintained by the network operator to generate a first set of data comprising at least a portion of the set of raw data with sensitive data associated with the one or more users removed; a second set of data comprising the sensitive data removed from the set of raw data; and a third set of data comprising a mapping between portions of the set of raw data and the first set of data. The first set of data is exposed to a third party, while the second set of data and the third set of data are isolated from the third party.

Privacy protection for third party data sharing

A first security service function chain is generated that identifies at least a first service function path comprising an identified set of security service functions, with at least one of the identified set of security service functions comprising a virtualized network function in a software defined networking (SDN) network architecture. The first security service function chain is utilized to create classification policies associating packets of a given packet type with the first security service function chain, and the first service function path is utilized to create forwarding policies specifying handling of packets of the given packet type by respective ones of the identified set of security service functions. The classification policies are provided to one or more nodes in a communication network comprising the SDN network architecture, and the forwarding policies are provided to one or more of the identified set of security service functions in the communication network.

Security-on-demand architecture

Embodiments of the present disclosure relate to a method and a device for providing a security service. For example, the method comprises: in response to receiving, at a first controller, a first request to create a first service chain for an application in a network, obtaining configuration information associated with the security service from the first request; generating, based on the configuration information, a second request to create a sequence of security functions associated with the first service chain; sending the second request to a second controller so as to create the sequence of security functions in the network; and in response to receiving from the second controller an acknowledgement for the sequence of security functions, creating the first service chain based on the sequence of security functions. Embodiments of the device are capable of implementing the above method.

Method and device for providing a security service

Embodiments of the present disclosure relate to method and device for interworking between service function chain (i.e., service chain) domains In some embodiments, there is provided a communication method comprising: receiving, at a first logic node of a first service chain in a first domain, a first packet associated with a second service chain in a second domain; converting the first packet into a second packet comprising first interworking information between the first service chain and the second service chain, the first interworking information comprising a flag indicating that the second packet is an interworking packet, an address of the first logic node, a first flow identifier of the second packet, a first service path identifier of the second packet and metadata associated with the second service chain; transmitting the second packet to a second logic node in the second domain; and receiving from the second logic node a response to the metadata.

Method and device for interworking between service function chain domains

A security service function chain is created including a set of security service functions. The security service function chain is created in response to instantiation of a given network partition (e.g., network slice) in a communication network (5G or similar network). The communication network supports instantiation of a plurality of network partitions for providing a respective plurality of network services. The security service function chain is utilized to perform at least one security service (e.g., authentication) for an entity (e.g., a subscriber or a device) accessing or seeking access to a network service (e.g., one of eMBB, massive IoT, and mission-critical IoT) corresponding to the given network partition.

Unified security architecture

A method, a device, an apparatus and a computer-readable storage medium for MAC address conflict detection. The method includes: in response to detecting a wireless local area network, transmitting, at a first device, a dummy MAC address of the first device to a second device in the wireless local area network, the dummy MAC address being different from a real MAC address of the first device; transmitting an address conflict detection request for the dummy MAC address to the second device; and in response to an address conflict detection response from the second device indicating that there is no conflict for the dummy MAC address, establishing a connection with the wireless local area network. The method may effectively protect privacy information for a user of a terminal device, while avoiding a MAC address conflict, such that the user can communicate in a secure network environment.

Method, device, apparatus for MAC address conflict detection and computer readable storage medium

Embodiments provide a user equipment (UE) device that includes a processor and a transceiver. The processor is configured to direct a handover request to an evolved packet core (EPC) access node via the transceiver. The access node may be, e.g. a wireless local area network (WLAN) access point or an E-UTRAN access point. The handover request may initiate a transfer of connectivity of the UE device from the WLAN access point to the E-UTRAN access point, or from the E-UTRAN access point to the WLAN access point. The processor is configured to receive a handover response from the current access node, wherein the response includes a cryptographic key identifier, and to derive a handover key from the key identifier. The processor may then operate the UE device to provide connectivity based on the handover key between the UE device and the other of the access nodes.

Handover between E-UTRAN and WLAN

At least one security policy is obtained from a policy creator at a controller in an SDN network. The security policy is implemented in the SDN network, via the controller, based on one or more attributes specifying a characteristic of the security policy, a role of the creator of the security policy, and a security privilege level of the role of the creator of the security policy.

Growing community of inventors

Shanghai, China

Zhigang Luo