Function selection in industrial networks
In one embodiment, a device associates available 5G functions stored by a network repository function with contextual information, wherein the contextual information maps each of the available 5G functions with a layer of a hierarchical security model for an industrial network. The device receives a request from a user equipment endpoint to communicate via the industrial network. The device selects a particular user plane function from among the available 5G functions for use by the user equipment endpoint based in part on the layer of the hierarchical security model associated with the particular user plane function. The device causes the user equipment endpoint to communicate via the industrial network using the particular user plane function.
1 . A method, comprising:
associating, by a device, available 5G functions stored by a network repository function with contextual information, wherein the contextual information maps each of the available 5G functions with a layer of a hierarchical security model topology for an industrial network within which that available 5G function is deployed;
receiving, at the device, a request from a user equipment endpoint to communicate via the industrial network;
selecting, by the device, a particular user plane function from among the available 5G functions for use by the user equipment endpoint based in part on the layer of the hierarchical security model associated with the particular user plane function; and
causing, by the device, the user equipment endpoint to communicate via the industrial network using the particular user plane function.
2 . The method of claim 1 , wherein the hierarchical security model is a Purdue Model or IEC 62443 Model.
3 . The method of claim 1 , wherein the user equipment endpoint communicates with an actuator or sensor via the industrial network.
4 . The method of claim 1 , further comprising:
causing the particular user plane function to be configured with a security policy based on the hierarchical security model.
5 . The method of claim 4 , wherein the security policy restricts traffic associated with the user equipment endpoint to a particular cell within a given layer of the hierarchical security model.
6 . The method of claim 1 , further comprising:
utilizing a tunneling mechanism to deliver traffic from the particular user plane function to a particular cell of the industrial network.
7 . The method of claim 6 , further comprising:
exempting the traffic delivered from the particular user plane function to the particular cell of the industrial network by the tunneling mechanism from security services applicable to other cell-external traffic.
8 . The method of claim 1 , wherein the hierarchical security model is based in part on deep packet inspection of traffic associated with endpoints within the industrial network.
9 . The method of claim 1 , wherein the particular user plane function is selected from among the available 5G functions for use based in part on the particular user plane function natively supporting required security services applicable to traffic associated with the user equipment endpoint.
10 . The method of claim 1 , wherein the particular user plane function is selected from among the available 5G functions for use based in part on the particular user plane function supporting required security services applicable to traffic associated with the user equipment endpoint via service chaining.
11 . An apparatus, comprising:
one or more network interfaces;
a processor coupled to the one or more network interfaces and configured to execute one or more processes; and
a memory configured to store a process that is executable by the processor, the process when executed configured to:
associate available 5G functions stored by a network repository function with contextual information, wherein the contextual information maps each of the available 5G functions with a layer of a hierarchical security model topology for an industrial network within which that available 5G function is deployed;
receive a request from a user equipment endpoint to communicate via the industrial network;
select a particular user plane function from among the available 5G functions for use by the user equipment endpoint based in part on the layer of the hierarchical security model associated with the particular user plane function; and
cause the user equipment endpoint to communicate via the industrial network using the particular user plane function.
12 . The apparatus of claim 11 , wherein the hierarchical security model is a Purdue Model or IEC 62443 Model.
13 . The apparatus of claim 11 , wherein the user equipment endpoint communicates with an actuator or sensor via the industrial network.
14 . The apparatus of claim 11 , wherein the process when executed is further configured to:
cause the particular user plane function to be configured with a security policy based on the hierarchical security model.
15 . The apparatus of claim 14 , wherein the security policy restricts traffic associated with the user equipment endpoint to a particular cell within a given layer of the hierarchical security model.
16 . The apparatus of claim 11 , wherein the process when executed is further configured to:
utilize a tunneling mechanism to deliver traffic from the particular user plane function to a particular cell of the industrial network.
17 . The apparatus of claim 16 , wherein the process when executed is further configured to:
exempt the traffic delivered from the particular user plane function to the particular cell of the industrial network by the tunneling mechanism from security services applicable to other cell-external traffic.
18 . The apparatus of claim 11 , wherein the hierarchical security model is based in part on deep packet inspection of traffic associated with endpoints within the industrial network.
19 . The apparatus of claim 11 , wherein the particular user plane function is selected from among the available 5G functions for use based in part on the particular user plane function natively supporting required security services applicable to traffic associated with the user equipment endpoint.
20 . A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising:
associating, by the device, available 5G functions stored by a network repository function with contextual information, wherein the contextual information maps each of the available 5G functions with a layer of a hierarchical security model topology for an industrial network within which that available 5G function is deployed;
receiving, at the device, a request from a user equipment endpoint to communicate via the industrial network;
selecting, by the device, a particular user plane function from among the available 5G functions for use by the user equipment endpoint based in part on the layer of the hierarchical security model associated with the particular user plane function; and
causing, by the device, the user equipment endpoint to communicate via the industrial network using the particular user plane function.