Trusted 5G network slices
Slice control elements in a 5G slicing framework are instantiated in trusted hardware to provide for sealed data transmission in a trusted slice. In addition to sealing the data plane in the trusted slice, the control plane for the slice may be secured by the instantiation into the trusted hardware of layer 2 (medium access control—MAC) scheduling functions for radio resources (e.g., subcarriers and time slots). Layer 1 (physical—PHY) may also be configured to further enhance security of the trusted slice by isolating its PHY layer from that of other trusted and non-trusted slices. Such isolation may be implemented, for example, by using dedicated PHY resources, or by limiting resource time sharing to provide temporal isolation.
1. A computer-implemented method for operating a 5G (fifth generation) radio access network (RAN), the method comprising:
partitioning physical radio resources for the RAN into a plurality of segments each being defined by physical transmission parameters for an air interface over which data transmissions are carried from user equipment (UE) to a radio unit (RU) with which the RAN interoperates;
distributing one or more trusted execution environments (TEEs) in physical infrastructure of at least one RAN slice among a plurality of RAN slices;
instantiating a scheduler in at least one TEE; and
operating the scheduler in the at least one TEE to schedule subsets of the physical radio resources to the at least one RAN slice, wherein the operating includes using cryptographic techniques to bind the data transmissions from the UE to the at least one RAN slice in which the one or more TEEs are distributed.
2. The computer-implemented method of claim 1 in which the radio resource segments are defined by respective numerologies.
3. The computer-implemented method of claim 1 in which the physical transmission parameters comprise one of waveform, sampling rate, symbol duration, frame length or subframe length.
4. The computer-implemented method of claim 1 in which the scheduler operates responsively to a control plane element in the RAN.
5. The computer-implemented method of claim 4 in which the control plane element comprises a near-real-time RAN intelligent controller (near-RT RIC).
6. The computer-implemented method of claim 5 in which the near-RT RIC includes a trusted slice controller that is instantiated in a TEE.
7. The computer-implemented method of claim 1 in which the scheduler comprises a MAC (Medium Access Control) layer component configured to control intra-RAN slice resource allocation.
8. The computer-implemented method of claim 7 further including dedicating physical layer resources to the at least one RAN slice.
9. The computer-implemented method of claim 1 in which the at least one TEE is implemented using a trusted enclave.
10. The computer-implemented method of claim 1 in which the at least one RAN slice comprises a user plane that is trusted using one or more of sealing or end-to-end encryption.
11. One or more hardware-based computer-readable memory devices storing computer-executable instructions which, upon execution by one or more processors disposed in a computing device deployed in a 5G (fifth generation) network having an air interface between a radio unit (RU) and a plurality of user equipment (UE) and in which the 5G network comprises a plurality of slices, cause the computing device to:
partition physical radio resources for a radio access network (RAN) that interoperates with RU into a plurality of segments each being defined by physical transmission parameters for the air interface over which data transmissions are carried from the UE to the RU;
distribute one or more trusted execution environments (TEEs) in physical infrastructure of at least one RAN slice among a plurality of RAN slices;
instantiate a scheduler in at least one TEE; and
operate the scheduler in the at least one TEE to schedule subsets of the physical radio resources to the at least one RAN slice, wherein the operating includes using cryptographic techniques to bind the data transmissions from the UE to the at least one RAN slice in which the one or more TEEs are distributed.
12. The one or more hardware-based computer-readable memory devices of claim 11 in which the physical transmission parameters comprise one of waveform, sampling rate, symbol duration, frame length or subframe length.
13. The one or more hardware-based computer-readable memory devices of claim 11 in which the control plane element comprises a near-real-time RAN intelligent controller (near-RT RIC).
14. The one or more hardware-based computer-readable memory devices of claim 13 in which the near-RT RIC includes a trusted slice controller that is instantiated in a TEE.
15. The one or more hardware-based computer-readable memory devices of claim 11 in which the at least one TEE is implemented using a trusted enclave.
16. A computing device deployed in a 5G (fifth generation) network having an air interface between a radio unit (RU) and a plurality of user equipment (UE) and in which the 5G network comprises a plurality of slices, the computing device comprising:
at least one processor; and
at least one hardware-based computer-readable storage device having computer-executable instructions stored thereon which, when executed by the least one processor, cause the computing device to:
partition physical radio resources for a radio access network (RAN) that interoperates with the RU into a plurality of segments each being defined by physical transmission parameters for an air interface over which data transmissions are carried from the UE to the RU;
distribute one or more trusted execution environments (TEEs) in physical infrastructure of at least one RAN slice among a plurality of RAN slices;
instantiate a scheduler in at least one TEE; and
operate the scheduler in the at least one TEE to schedule subsets of the physical radio resources to the at least one RAN slice, wherein the operating includes using cryptographic techniques to bind the data transmissions from the UE to the at least one RAN slice in which the one or more TEEs are distributed.
17. The computing device of claim 16 in which the physical transmission parameters comprise one of waveform, sampling rate, symbol duration, frame length or subframe length.
18. The computing device of claim 16 in which the control plane element comprises a near-real-time RAN intelligent controller (near-RT RIC).
19. The computing device of claim 18 in which the near-RT RIC includes a trusted slice controller that is instantiated in a TEE.
20. The computing device of claim 16 in which the at least one TEE is implemented using a trusted enclave.