Granted Patent B2

US 12,212,604 · App. 17/607,082 · Granted Jan 28, 2025

Inventors: Jing Ping (Chengdu, CN); Xiaoming She (Chengdu, CN); Shuqiang Sun (Chengdu, CN); Wei Lu (Beijing, CN); Stéphane Mahieu (Munich, DE)

Assignee: NOKIA TECHNOLOGIES OY

H04L63/20H04L41/40H04L43/50

Abstract

Claims (63)

1. A method, comprising:

generating original security requirements for a network or management function based on a security profile and a deployment and runtime environment of the network or management function;

generating a security policy and a security test specification for the network or management function based on the security requirements;

deploying and configuring the network or management function based on the security policy;

validating security compliance of the network or management function with the security test specification; and activating the network or management function, in response to the network or management function being in compliance with the security policy;

wherein the method further comprises: updating the original security requirements in response to: a change to the security profile; a change to the deployment and runtime environment of the network or management function; a change to a security state of the network function; and an update request;

wherein the deployment and runtime environment comprises a deployment country/region; an applied industry; a deployment mode; a running ecosystem; and additional requirements provided by a network function vendor, a network operator and a service provider, and

wherein the security policy at least defines: a security configuration of the network or management function, a security function and a configuration of the security function.

2. The method according to claim 1 , further comprising:

identifying semantically identical security requirements and semantically similar security requirements from the original security requirements, wherein semantic similarities between the original security requirements are calculated based on a distance of the internal representations of the original security requirements, wherein the semantic similarity is represented as a distance between a plurality of paragraph vectors of the original security requirements and security requirements with a semantic similarity greater than a first threshold are identified as semantically identical security requirements, and security requirements with a semantic similarity greater than a second threshold are identified as semantically similar security requirements, wherein the first threshold is higher than the second threshold;

removing extra semantically identical security requirements, wherein only one of the semantically identical security requirements is kept in the final security requirements;

combining the semantically similar security requirements into a combined security requirement, wherein the combined security requirement has the highest security degree.

3. The method according to claim 1 , wherein the deployment mode indicates that the network or management function is deployed as one of a physical node, a virtualized node, and a hybrid node, and wherein the running ecosystem indicates that a communication network in which the network or management function will operate is one of a public network, a private network, and a hybrid network.

4. The method according to claim 1 , wherein the generation of the security requirements and the security test specification are implemented in an intelligent model.

5. The method according to claim 1 , wherein the security test comprises a test case, one or more test tools which are used to execute the test case, a test schedule which defines a scheduling of the test case, and a test configuration for configuring the one or more test tools.

6. The method according to claim 5 , wherein validating security compliance of the network or management function based on the security test specification comprises:

for each of the at least one security test in the security test specification,

configuring one or more test tools according to the test configuration;

executing the test case according to the test schedule to determine whether the security test is passed; and

determining, in response to all of the at least one security test being passed, that the network or management function is in compliance with the security requirements; and

determining, in response to any one of the at least one security test being not passed, that the network or management function is not in compliance with the security requirements.

7. An apparatus, comprising:

at least one processor; and

at least one memory including computer executable instructions;

the at least one memory and the computer executable instructions configured to, with the at least one processor, cause the apparatus to:

generate original security requirements for a network or management function based on a security profile and a deployment and runtime environment of the network or management function;

generate a security policy and a security test specification for the network or management function based on the original security requirements;

deploy and configure the network or management function based on the security policy;

validate security compliance of the network or management function with the security test specification; and

activate the network entity, in response to the network or management function being in compliance with the security policy;

wherein the at least one memory and the computer executable instructions are configured to, with the at least one processor, further cause the apparatus to: update the original security requirements in response to: a change to the security profile; a change to the deployment and runtime environment of the network or management function; a change to a security state of the network function; and an update request;

wherein the deployment and runtime environment comprises a deployment country/region; an applied industry; a deployment mode; a running ecosystem; and

additional requirements provided by a network function vendor, a network operator and a service provider, and

wherein the security policy at least defines: a security configuration of the network or management function, a security function and a configuration of the security function.

8. The apparatus according to claim 7 , wherein the at least one memory and the computer executable instructions are configured to, with the at least one processor, further cause the apparatus to:

identify semantically identical security requirements and semantically similar security requirements from the original security requirements, wherein semantic similarities between the original security requirements are calculated based on a distance of the internal representations of the original security requirements, wherein the semantic similarity is represented as a distance between a plurality of paragraph vectors of the original security requirements and security requirements with a semantic similarity greater than a first threshold are identified as semantically identical security requirements, and security requirements with a semantic similarity greater than a second threshold are identified as semantically similar security requirements, wherein the first threshold is higher than the second threshold;

remove extra semantically identical security requirements, wherein only one of the semantically identical security requirements is kept in the final security requirements;

combine the semantically similar security requirements into a combined security requirement, wherein the combined security requirement has the highest security degree.

9. The apparatus according to claim 7 , wherein the deployment mode indicates that the network or management function is deployed as one of a physical node, a virtualized node, and a hybrid node; and

wherein the running ecosystem indicates that a communication network in which the network or management function will operate is one of a public network, a private network, and a hybrid network.

10. The apparatus according to claim 7 , wherein the security test specification defines at least one security test.

11. The apparatus according to claim 7 , wherein the generation of the security requirements and the security test specification are implemented in an intelligent model.

12. The apparatus according to claim 7 , wherein the security test comprises a test case, one or more test tools which are used to execute the test case, a test schedule which defines a scheduling of the test case, and a test configuration for configuring the one or more test tools.

13. The apparatus according to claim 12 , wherein the at least one memory and the computer executable instructions are configured to, with the at least one processor, cause the apparatus to:

for each of the at least one security test in the security test specification,

configure one or more test tools according to the test configuration;

execute the test case according to the test schedule to determine whether the security test is passed; and

determine, in response to all of the at least one security test being passed, that the network entity is in compliance with the security requirements; and

determine, in response to any one of the at least one security test being not passed, that the network or management function is not in compliance with the security requirements.

14. The apparatus according to claim 13 , wherein the at least one memory and the computer executable instructions are configured to, with the at least one processor, further cause the apparatus to: generate a security test report which recommends a subsequent action if the network or management function is not in compliance with the security requirements.

15. The apparatus according claim 7 , wherein the at least one memory and the computer executable instructions are configured to, with the at least one processor, further cause the apparatus to: monitor, upon the activation of the network entity, a security state of the network or management function in operation;

and generate a security monitoring report, the security monitoring report indicating the monitored security state and recommending a subsequent action if the monitored security state indicates an unsafe state.

16. The apparatus according to claim 7 , wherein the at least one memory and the computer executable instructions are configured to, with the at least one processor, further cause the apparatus to: update the security requirements in response to: a change to the security profile; a change to the deployment and runtime environment of the network or management function; a change to a security state of the network function; and an update request.

17. A non-transitory computer readable storage medium storing thereon computer executable instructions which, when executed by a computer, cause the computer to perform:

generating original security requirements for a network or management function based on a security profile and a deployment and runtime environment of the network or management function;

generating a security policy and a security test specification for the network function based on the security requirements;

deploying and configuring the network or management function based on the security policy;

validating security compliance of the network or management function with the security test specification; and

activating the network entity, in response to the network or management function being in compliance with the security policy,

wherein the non-transitory computer readable storage medium storing thereon computer executable instructions which, when executed by a computer, further cause the computer to perform: updating the original security requirements in response to: a change to the security profile; a change to the deployment and runtime environment of the network or management function; a change to a security state of the network function; and an update request;

wherein the deployment and runtime environment comprises a deployment country/region; an applied industry; a deployment mode; a running ecosystem; and

additional requirements provided by a network function vendor, a network operator and a service provider and

wherein the security policy at least defines: a security configuration of the network or management function, a security function and a configuration of the security function.

Assignments (1)

Continuity (1)

References Cited (24)