Apparatus, methods, and computer programs for protecting sensitive data
There is provided a method, computer program, and an apparatus for a network function service consumer, that causes the apparatus to perform: retrieving, from a first repository function, protected sensitive data; retrieving, from a second network function, at least one encrypted key; decrypting the retrieved at least one encrypted key using a private key associated with the network function service consumer to obtain a respective at least one key; and performing at least one of: decryption of the protected sensitive data using the at least one key to obtain sensitive data or integrity protected sensitive data; or verification of the integrity of the protected sensitive data using the at least one key.
1 . An apparatus for a network function service consumer, the apparatus comprising:
at least one processor; and
at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to:
retrieve, from a first repository function, protected sensitive data, wherein the sensitive data comprises a machine learning model;
retrieve, from a second network function, at least one encrypted key, wherein the at least one encrypted key comprises an encrypted first key for integrity verification of the protected sensitive data;
decrypt the retrieved at least one encrypted key using a private key associated with the network function service consumer to obtain a respective at least one key; and
at least one of:
decrypt the protected sensitive data using the at least one key to obtain sensitive data or integrity protected sensitive data; or
verify the integrity of the protected sensitive data using the at least one key.
2 . The apparatus of claim 1 , wherein the at least one memory and the instructions are configured to, with the at least one processor, further cause the apparatus to:
obtain, from a network repository function, an access token for authorising the apparatus to have access to the protected sensitive data;
provide the access token to the first repository function as part of a service request for the protected sensitive data; and
receive the protected sensitive data in response to said providing.
3 . The apparatus of claim 2 , wherein the receiving the protected sensitive data comprises:
receive an address from which the protected sensitive data may be downloaded; and
download the protected sensitive data from the address.
4 . The apparatus of claim 2 , wherein the at least one memory and the instructions are configured to, with the at least one processor, further cause the apparatus to:
receive, from the first repository function, at least one of:
an indication that the protected sensitive data is encrypted;
an indication that the second network function comprises a key for decrypting the protected sensitive data;
an indication that the protected sensitive data is integrity protected; or
an indication that the second network function comprises a key and/or metadata associated with verifying the protected sensitive data.
5 . The apparatus of claim 2 , wherein the at least one memory and the instructions are configured to, with the at least one processor, further cause the apparatus to:
signal, to a network repository function, a request for the access token; wherein
the request comprises an indication that the apparatus is configured to decrypt and/or verify protected sensitive data, and either a public key or an indication of where to obtain the public key; and wherein
the public key is a public key of the network function service consumer to be used for encrypting the at least one key.
6 . The apparatus of claim 5 , wherein the indication of where to obtain the public key comprises one of the following:
from a transport layer security, TLS, certificate; or
from a client credentials assertion, CCA.
7 . The apparatus of claim 1 , wherein the second network function is a network repository function.
8 . The apparatus of claim 1 , wherein the second network function is a network function service producer and/or a network analytics data function.
9 . The apparatus of claim 1 , wherein the at least one encrypted key further comprises:
an encrypted second key for decrypting the protected sensitive data.
10 . An apparatus for a network function service producer, the apparatus comprising:
at least one processor; and
at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to:
protect sensitive data using at least one key to form protected sensitive data, wherein the sensitive data comprises a machine learning model, and wherein the at least one key comprises an encrypted first key for integrity verification of the protected sensitive data;
register the protected sensitive data at a first repository function; and
provide the at least one key to a network function.
11 . The apparatus of claim 10 , wherein the providing the at least one key to a network function comprises:
provide the at least one key to a network repository function.
12 . The apparatus of claim 10 , wherein the providing the at least one key to a network function comprises:
receive a request for the at least one key from a network function service consumer;
encrypt the at least one key using a public key associated with the network function service consumer to form at least one encrypted key; and
provide the at least one encrypted key to the network function service consumer.
13 . The apparatus of claim 10 , wherein the request for the at least one key comprises the public key or an indication of where to obtain the public key.
14 . The apparatus of claim 13 , wherein the indication of where to obtain the public key comprises an indication of one of the following:
from a transport layer security, TLS, certificate; or
from a client credentials assertion, CCA.
15 . The apparatus of claim 10 , wherein the at least one key further comprises:
an encrypted second key for decrypting the protected sensitive data.
16 . The apparatus of claim 10 , wherein the at least one memory and the instructions are configured to, with the at least one processor, further cause the apparatus to:
register a profile for the network function service producer at a network repository function, wherein the profile comprises an indication that the network function service producer is able to provide the at least one key to the network function.
17 . An apparatus for a network repository function, the apparatus comprising:
at least one processor; and
at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus at least to:
store profile information for a first network function service producer, wherein the profile comprises an indication that the first network function service producer is able to provide at least one first key associated with verifying and/or decrypting a first protected sensitive data to another network function, wherein the first sensitive data comprises a machine learning model;
receive, from a first network function service consumer, a request for a first access token for enabling the first network function service consumer to obtain the at least one first key;
provide the first network function service consumer with the requested access token;
receive, from a second network function service producer, at least one second key associated with verifying and/or decrypting a second protected sensitive data, wherein the at least one second key comprises an encrypted key for integrity verification of the protected sensitive data; and
receive, from a second network function service consumer, a request for a second access token for accessing the second protected sensitive data, wherein
the request for the second access token comprises an indication that the second network function service consumer is configured to decrypt and/or verify protected sensitive data, and either a public key or an indication of where to obtain the public key; and wherein
the public key is a public key of the second network function service consumer;
encrypt the at least one second key using the public key to form at least one encrypted second key; and
provide the at least one encrypted second key to the network function service consumer.
18 . The apparatus of claim 17 , wherein the at least one encrypted second key is provided as part of an access token claim in response to the request for the access token.
19 . The apparatus of claim 17 , wherein the at least one second key further comprises an encrypted key for decrypting the protected sensitive data.