Unified security architecture

1. A method performed by a processing device, the method comprising:

creating, by a master authentication orchestrator function, at least one security service function chain comprising a set of security service functions, wherein the at least one security service function chain is created in response to instantiation of a given network partition in a communication network, wherein the communication network supports instantiation of a plurality of network partitions for providing a respective plurality of network services, each network partition of the plurality of network partitions including an authentication orchestrator created by the master authentication orchestrator function, and the master authentication orchestrator function is located on a core network included in the communication network; and

utilizing the at least one security service function chain to perform at least one security service for a client device performing one of accessing or seeking access to a network service corresponding to the given network partition, the at least one security service including facilitating a single sign-on (SSO) operation for the client device for the network service corresponding to the given network partition and another network service corresponding to another network partition,

the SSO operation including transmitting a SSO request from the authentication orchestrator of the another network partition to the master authentication orchestrator function, and receiving a SSO response from the authentication orchestrator of the given network partition from the master authentication orchestrator function.

2. The method of claim 1 , wherein the at least one security service comprises mutual authentication between the client device and the communication network.

3. The method of claim 2 , wherein the creation of the security service function chain utilized to perform the mutual authentication is managed by the authentication orchestrator for the given network partition.

4. The method of claim 3 , wherein each of the security service function chains comprise at least a subset of an authentication gateway function, an authentication function, an identity mapping function, and a confidentiality and integrity function.

5. The method of claim 4 , wherein the authentication gateway function is configured to:

receive a message from the client device;

extract authentication information from the received message;

compose an authentication request message from the extracted authentication information; and

forward the authentication request message to the authentication function.

6. The method of claim 4 , wherein the authentication gateway function is configured to:

receive an authentication-related message from the authentication function;

integrate authentication information from the received message into an access response message; and

forward the access response message to the client device.

7. The method of claim 4 , wherein the authentication gateway function is configured to:

receive key-related information from the authentication function; and

forward the key-related information to the confidentiality and integrity function.

8. The method of claim 4 , wherein the authentication function is configured to:

determine, from a plurality of authentication mechanisms, an authentication mechanism to use to perform access mutual authentication between the client device and the communication network.

9. The method of claim 4 , wherein the authentication function is configured to retrieve, from the identity mapping function, an actual identity associated with the client device based on a temporary identity associated with the client device assigned by the communication network.

10. The method of claim 4 , wherein the authentication function operating in a visited domain network in the communication network is configured to obtain, through the authentication orchestrator of the given network partition, authentication information for the client device from another authentication function in a home domain network in the communication network.

11. The method of claim 4 , wherein the authentication function is configured to:

maintain a database of authentication status and security context for a plurality of client devices performing one of accessing or seeking access to the communication network through the given network partition.

12. The method of claim 11 , wherein the authentication function is configured to:

reference the database of authentication status and security context for the client device to avoid performing a mutual authentication between the client device and the target network in response to after the client device initiating a handover to a target network.

13. The method of claim 4 , wherein the identity mapping function is configured to manage a relationship between an actual identity associated with the client device and a temporary identity assigned to the client device by the communication network.

14. The method of claim 4 , wherein the confidentiality and integrity function is configured to provide protection for signaling messages on a control plane of the network partition and for user data on a user plane of the network partition.

15. The method of claim 3 , wherein the authentication orchestrator for the given network partition is created and managed by the master authentication orchestrator function.

16. The method of claim 15 , wherein the master authentication orchestrator is configured to:

instantiate another authentication orchestrator function for another network partition during a scale-out operation; and

terminate another authentication orchestrator function for another network partition during a scale-in operation.

17. The method of claim 3 , wherein the authentication function is a first authentication function, and the authentication orchestrator for the given network partition is configured to instantiate a second authentication function for another network partition during a scale-out operation.

18. The method of claim 3 , wherein the authentication function is a first authentication function, and the authentication orchestrator for the given network partition is configured to instantiate a second authentication function for the given network partition when the first authentication function fails.

19. The method of claim 3 , wherein the authentication orchestrator for the given network partition is configured to provision and configure the authentication function.

20. The method of claim 3 , wherein the authentication orchestrator for the given network partition is configured to terminate another authentication function for another network partition during a scale in operation.

21. The method of claim 1 , wherein the utilizing the security service function chain to perform at least one security service for the client device further comprises:

utilizing the security service function chain to facilitate authenticated access by the client device to the network service corresponding to the given network partition.

22. The method of claim 1 , wherein the utilizing the security service function chain to perform at least one security service for the client device further comprises:

utilizing the security service function chain to facilitate handover of the client device from a source network to a target network while maintaining access to the network service corresponding to the given network partition.

23. The method of claim 1 , wherein the network service corresponding to the given network partition comprises an enhanced multimedia broadband service.

24. The method of claim 1 , wherein the network service corresponding to the given network partition comprises a machine-to-machine service.

25. An article of manufacture comprising a processor-readable non-transitory storage medium having embodied therein executable program code that when executed by a processing device causes the processing device to perform:

create, by a master authentication orchestrator function, at least one security service function chain comprising a set of security service functions, wherein the at least one security service function chain is created in response to instantiation of a given network partition in a communication network, wherein the communication network supports instantiation of a plurality of network partitions for providing a respective plurality of network services, each network partition of the plurality of network partitions including an authentication orchestrator created by the master authentication orchestrator function, and the master authentication orchestrator function is located on a core network included in the communication network; and

utilize the security service function chain to perform at least one security service for a client device performing one of accessing or seeking access to a network service corresponding to the given network partition, the at least one security service including facilitating a single sign-on (SSO) operation for the client device for the network service corresponding to the given network partition and another network service corresponding to another network partition,

the SSO operation including transmitting a SSO request from the authentication orchestrator of the another network partition to the master authentication orchestrator function, and receiving a SSO response from the authentication orchestrator of the given network partition from the master authentication orchestrator function.

26. An apparatus comprising:

a memory; and

at least one processor operatively coupled to the memory to form a unified security architecture, the unified security architecture being configured to:

create, by a master authentication orchestrator function, at least one security service function chain comprising a set of security service functions, wherein the at least one service function chain is created in response to instantiation of a given network partition in a communication network, wherein the communication network supports instantiation of a plurality of network partitions for providing a respective plurality of network services, each network partition of the plurality of network partitions including an authentication orchestrator created by the master authentication orchestrator function, and the master authentication orchestrator function is located on a core network included in the communication network; and

utilize the security service function chain to perform at least one security service for a client device performing one of accessing or seeking access to a network service corresponding to the given network partition, the at least one security service including facilitating a single sign-on (SSO) operation for the client device for the network service corresponding to the given network partition and another network service corresponding to another network partition,

the SSO operation including transmitting a SSO request from the authentication orchestrator of the another network partition to the master authentication orchestrator function, and receiving a SSO response from the authentication orchestrator of the given network partition from the master authentication orchestrator function.