METHOD AND APPARATUS FOR ISOLATION SUPPORT IN NETWORK SLICING

An example method may include receiving slice isolation policy for a network slice subnet (NSS) in a transport network (TN) domain, mapping the slice isolation policy to network resource isolation policy and traffic isolation policy, and mapping the network resource isolation policy and the traffic isolation policy to network resource allocation policy and data traffic forward policy, respectively. The network resource allocation policy and the data traffic forward policy may be applied in creation of the TN NSS.

TECHNICAL FIELD

Various example embodiments described herein generally relate to communication technologies, and more particularly, to communication methods and apparatus supporting fine-grained isolation policy in network slicing.

BACKGROUND

Certain abbreviations that may be found in the description and/or in the figures are herewith defined as follows:

5G NR is designed for a wide range of usage scenarios typically including for example enhanced Mobile Broad Band (eMBB), massive Machine Type Communication (mMTC) and ultra Reliable and Low Latency Communication (uRLLC). Many usage scenarios require different types of features and networks in terms of mobility, security, policy control, latency, coverage, reliability and the like. Therefore, network slicing has been proposed to slice one physical network into multiple virtual E2E networks to carry different types of services with different characteristics and requirements. With network slicing, various services for different companies and industries may be provided by one physical network and consequently network utilization is greatly improved.

SUMMARY

A brief summary of exemplary embodiments is provided below to provide basic understanding of some aspects of various embodiments. It should be noted that this summary is not intended to identify key features of essential elements or define scopes of the embodiments, and its sole purpose is to introduce some concepts in a simplified form as a preamble for a more detailed description provided below.

In a first aspect, an example embodiment of a method for isolation of a network slice is provided. The method may comprise receiving slice isolation policy for a network slice subnet (NSS) in a transport network (TN) domain, mapping the slice isolation policy to network resource isolation policy and traffic isolation policy, and mapping the network resource isolation policy and the traffic isolation policy to network resource allocation policy and data traffic forward policy, respectively. The network resource allocation policy and the data traffic forward policy may be applied in creation of the TN NSS.

In a second aspect, an example embodiment of a method for isolation of a network slice is provided. The method may comprise creating a data transport channel for a NSS in a TN complying with isolation policy for the TN NSS, collecting isolation relevant data of the TN NSS during operation of the TN NSS, and reporting the collected isolation relevant data to an isolation monitoring function at a higher layer.

In a third aspect, an example embodiment of a method for isolation of a network slice is provided. The method may comprise sending a request of collecting isolation monitoring data for a NSS to a transport control and management function of a TN, receiving the isolation monitoring data for the TN NSS from the transport control and management function, analyzing the isolation monitoring data to determine if slice isolation policy for the TN NSS is satisfied during operation of the TN NSS, and reporting the analysis result of the isolation monitoring data to an isolation monitoring function at a higher layer.

In a fourth aspect, an example embodiment of a method for isolation of a network slice is provided. The method may comprise receiving isolation monitoring information for a NSS of a NS, determining if slice isolation policy is properly enforced during operation of the NSS based on the received isolation monitoring information, the received isolation monitoring information comprising analysis results of isolation monitoring data with respect to attributes refined from the slice isolation policy, and generating an alarm when it is determined that at least a part of the slice isolation policy is not properly enforced.

In a fifth aspect, an example embodiment of a network function unit is provided. The network function unit may comprise at least one processor and at least one memory including computer program code. The at least one memory and the computer program code may be configured to, with the at least one processor, cause the network function unit to receive slice isolation policy for a NSS in a TN domain, map the slice isolation policy to network resource isolation policy and traffic isolation policy, and map the network resource isolation policy and the traffic isolation policy to network resource allocation policy and data traffic forward policy, respectively. The network resource allocation policy and the data traffic forward policy may be applied in creation of the TN NSS.

In a sixth aspect, an example embodiment of a network function unit is provided. The network function unit may comprise at least one processor and at least one memory including computer program code. The at least one memory and the computer program code may be configured to, with the at least one processor, cause the network function unit to create a data transport channel for a NSS in a TN complying with isolation policy for the TN NSS, collect isolation relevant data of the TN NSS during operation of the TN NSS, and report the collected isolation relevant data to an isolation monitoring function at a higher layer.

In a seventh aspect, an example embodiment of a network function unit for monitoring isolation of a network slice is provided. The network function unit may comprise at least one processor and at least one memory including computer program code. The at least one memory and the computer program code may be configured to, with the at least one processor, cause the network function unit to send a request of collecting isolation monitoring data for a NSS to a transport control and management function of a TN, receive the isolation monitoring data for the TN NSS from the transport control and management function, analyze the isolation monitoring data to determine if slice isolation policy for the TN NSS is satisfied during operation of the TN NSS, and report the analysis result of the isolation monitoring data to an isolation monitoring function at a higher layer.

In an eighth aspect, an example embodiment of a network function unit is provided. The network function unit may comprise at least one processor and at least one memory including computer program code. The at least one memory and the computer program code may be configured to, with the at least one processor, cause the network function unit to receive isolation monitoring information for a NSS of a NS, determine if slice isolation policy is properly enforced during operation of the NSS based on the received isolation monitoring information, the received isolation monitoring information comprising analysis results of isolation monitoring data with respect to attributes refined from the slice isolation policy, and generate an alarm when it is determined that at least a part of the slice isolation policy is not properly enforced.

In a ninth aspect, an example embodiment of an apparatus for isolation of a network slice is provided. The apparatus for isolation of a network slice may comprise means for receiving slice isolation policy for a NSS in a TN domain, means for mapping the slice isolation policy to network resource isolation policy and traffic isolation policy, and means for mapping the network resource isolation policy and the traffic isolation policy to network resource allocation policy and data traffic forward policy, respectively. The network resource allocation policy and the data traffic forward policy may be applied in creation of the TN NSS.

In a tenth aspect, an example embodiment of an apparatus for isolation of a network slice is provided. The apparatus for isolation of a network slice may comprise means for creating a data transport channel for a NSS in a TN complying with isolation policy for the TN NSS, means for collecting isolation relevant data of the TN NSS during operation of the TN NSS, and means for reporting the collected isolation relevant data to an isolation monitoring function at a higher layer.

In an eleventh aspect, an example embodiment of an apparatus for monitoring isolation of a network slice is provided. The apparatus for monitoring isolation of a network slice may comprise means for sending a request of collecting isolation monitoring data for a NSS to a transport control and management function of a TN, means for receiving the isolation monitoring data for the TN NSS from the transport control and management function, means for analyzing the isolation monitoring data to determine if slice isolation policy for the TN NSS is satisfied during operation of the TN NSS, and means for reporting the analysis result of the isolation monitoring data to an isolation monitoring function at a higher layer.

In a twelfth aspect, an example embodiment of an apparatus for monitoring isolation of a network slice is provided. The apparatus for monitoring isolation of a network slice may comprise means for receiving isolation monitoring information for a NSS of a NS, means for determining if slice isolation policy is properly enforced during operation of the NSS based on the received isolation monitoring information, and means for generating an alarm when it is determined that at least a part of the slice isolation policy is not properly enforced. The received isolation monitoring information may comprise analysis results of isolation monitoring data with respect to attributes refined from the slice isolation policy.

In a thirteenth aspect, an example embodiment of a computer readable medium is provided. The computer readable medium may have instructions stored thereon. The instructions, when executed by at least one processor of a network function unit, may cause the network function unit to receive slice isolation policy for a NSS in a TN domain, map the slice isolation policy to network resource isolation policy and traffic isolation policy, and map the network resource isolation policy and the traffic isolation policy to network resource allocation policy and data traffic forward policy, respectively. The network resource allocation policy and the data traffic forward policy may be applied in creation of the TN NSS.

In a fourteenth aspect, an example embodiment of a computer readable medium is provided. The computer readable medium may have instructions stored thereon. The instructions, when executed by at least one processor of a network function unit, may cause the network function unit to create a data transport channel for a NSS in a TN complying with isolation policy for the TN NSS, collect isolation relevant data of the TN NSS during operation of the TN NSS, and report the collected isolation relevant data to an isolation monitoring function at a higher layer.

In a fifteenth aspect, an example embodiment of a computer readable medium is provided. The computer readable medium may have instructions stored thereon. The instructions, when executed by at least one processor of a network function unit, may cause the network function unit to send a request of collecting isolation monitoring data for a NSS to a transport control and management function of a TN, receive the isolation monitoring data for the TN NSS from the transport control and management function, analyze the isolation monitoring data to determine if slice isolation policy for the TN NSS is satisfied during operation of the TN NSS, and report the analysis result of the isolation monitoring data to an isolation monitoring function at a higher layer.

In a sixteenth aspect, a computer readable medium is provided. The computer readable medium may have instructions stored thereon. The instructions, when executed by at least one processor of a network function unit, may cause the network function unit to receive isolation monitoring information for a NSS of a NS, determine if slice isolation policy is properly enforced during operation of the NSS based on the received isolation monitoring information, and generate an alarm when it is determined that at least a part of the slice isolation policy is not properly enforced. The received isolation monitoring information may comprise analysis results of isolation monitoring data with respect to attributes refined from the slice isolation policy.

Other features and advantages of the example embodiments of the present disclosure will also be apparent from the following description of specific embodiments when read in conjunction with the accompanying drawings, which illustrate, by way of example, the principles of example embodiments of the present disclosure.

Throughout the drawings, same or similar reference numbers indicate same or similar elements. A repetitive description on the same elements would be omitted.

DETAILED DESCRIPTION

Herein below, some example embodiments are described in detail with reference to the accompanying drawings. The following description includes specific details for the purpose of providing a thorough understanding of various concepts. However, it will be apparent to those skilled in the art that these concepts may be practiced without these specific details. In some instances, well known circuits, techniques and components are shown in block diagram form to avoid obscuring the described concepts and features.

A network slice is a logical communication network that operates on top of a physical network, and multiple network slices operating on one physical network may share network resources. A challenge to network slicing is to ensure isolation between network slices because some tenants may need to run a sensitive service in a network slice that is isolated to some extent from other services. E2E network slicing spans across multiple parts of the network such as the access network (AN), the transport network (TN) and the core network (CN). Transport network slicing can be applied for connecting the access network to the core network, and also applied within the core network. For example, a transport network slice may connect an access network to a user plane function (UPF) in a core network, or connect a set of user plane functions to a session management function (SMF) in the core network. E2E slice isolation needs to be ensured in the access network, the transport network and the core network. Hereinafter, example embodiments of isolation for network slices will be described with reference to the transport network, but it would be appreciated that the isolation solutions provided by the transport network are also applicable to the access network and the core network.

FIG.1illustrates architecture of network functions for network slice management in which example embodiments of the present disclosure can be implemented. Referring toFIG.1, a network slice consumer portal110is provided for the tenants to conduct control and management on the E2E network slices. For example, the network slice consumer portal110may receive from a tenant a request to create an E2E network slice along with a Service Level Agreement (SLA) or a service profile that specifies requirements such as bandwidth, rate, latency, connectivity, mobility or the like for services to be run on the network slice. If the SLA is received, it may be converted into the service profile. The network slice consumer portal110may forward the request to create a slice and the service profile to a network slice management function (NSMF)120for creation of the slice. The tenant may also for example monitor and re-configure network slices through the network slice consumer portal110.

When the NSMF120receives the request to create a network slice and the service profile, it may create a network slice instance (NSI) according to the service profile. For example, the NSMF120may map the service profile to a slice profile and establish a network resource model (NRM) for the slice. The NSMF120may further break down the slice profile into domain slice profiles and call domain management functions to create domain NSSs based on respective domain slice profiles. For example, the NSMF120may call an AN network slice subnet management function (NSSMF)140to create an NSS instance in the AN domain, a TN NSSMF130to create an NSS instance in the TN domain, and a CN NSSMF150to create an NSS instance in the CN domain. It would be understood that the NSMF120may include a plurality of functions or sub-functions to create and manage network slice instances. For example, the NSMF120may include an NS orchestration function, an NS security function, an NS resource model function, an NS instance function, and the like. The functions or sub-functions of the NSMF120may be deployed as respective stand-alone network functions or deployed together at the same host device. It would also be understood that the domain NSSMFs130,140,150may include a plurality of functions or sub-functions to create and manage network slice subnet instances in their own domains. For example, the domain NSSMFs130,140,150each may include an NSS orchestration function, an NSS security function, an NSS resource model function, an NSS instance function, and the like. The functions or sub-functions of the domain NSSMFs130,140,150may be deployed as respective stand-alone network functions or deployed together at the same host device. The network functions or sub-functions, also referred to as network function units, may be implemented by using hardware or running software on hardware, or may be implemented in a form of virtual functions on a common hardware platform.

It has been recognized by the industries that isolation is an important requirement for the E2E network slices. Isolation refers to a degree of resource sharing that could be tolerated by the tenants, and the tenants may require different levels of isolation. For example, some tenants may not mind to share network resources with others, while some tenants may want to use dedicated physical or logic resources for all or a particular type of service data. Hereinafter, example embodiments of methods and apparatus for isolation support in network slicing will be discussed. In some example embodiments, fine-grained isolation policy is supported by the E2E network slice, thereby the network slice can satisfy demands of the tenants for various isolation requirements.

FIG.2illustrates a block diagram of network functions for providing E2E slice isolation in accordance with some example embodiments. InFIG.2, network functions the same as or similar to those shown inFIG.1are denoted with the same reference signs and repetitive description thereof are omitted herein.

Referring toFIG.2, the NSMF120may include an isolation management function122and an isolation monitoring function124. The isolation management function122and the isolation monitoring function124each may be deployed as a stand-alone network function or deployed together with other NSMFs for example but not limited to the NS orchestration function at the same host device. The isolation management function122may be configured to establish slice isolation policy for a network slice and assist the NSMF120to create a network slice instance (NSI) based on the slice isolation policy. The isolation monitoring function124may be configured to monitor if the slice isolation policy is properly enforced in the network slice instance. Operations of the isolation management function122and the isolation monitoring function124will be discussed in detail later.

The TN NSSMF130may include a TN isolation control function132and a TN isolation monitoring function134. The TN isolation control function132and the TN isolation monitoring function134each may be deployed as a stand-alone network function or deployed together with other NSSMFs for example but not limited to the NSS orchestration function at the same host device. The TN isolation control function132may be configured to establish isolation policy for a network slice subnet in the TN domain and assist the TN NSSMF130to create a network slice subnet (NSS)190based on the isolation policy. The TN isolation monitoring function134may be configured to collect isolation monitoring data relating to the TN NSS190, analyze the isolation monitoring data and report analysis results to a isolation monitoring function at a higher layer, for example the isolation monitoring function124. Operations of the TN isolation control function132and the TN isolation monitoring function134will be discussed in detail later.

Although not shown inFIG.2, the domain isolation control function132and the domain isolation monitoring function134may also be applied in the access network domain and the core network domain. For example, the AN NSSMF140may create an AN NSS170with assistance of an AN isolation control function, and an AN isolation monitoring function may be configured to monitor isolation of the AN NSS170. The CN NSSMF150may create a CN NSS180with assistance of a CN isolation control function, and a CN isolation monitoring function may be configured to monitor isolation of the CN NSS180.

A transport control and management function160, which may comprise for example a software defined network (SDN) controller, a network controller, or an SDN orchestrator, is provided to report status of data transport channels to the TN isolation control function132. In some embodiments, the transport control and management function160may periodically and actively report status of active data transport channels to the TN isolation control function132, or in some embodiments the transport control and management function160may report status of active data transport channels to the TN isolation control function132in response to a request from the TN isolation control function132for status of the active data transport channels. The TN isolation control function132may select one or more of the reported data transport channels that comply with the isolation policy for the TN NSS190and notify the TN NSSMF130of the selected one or more data transport channels. In some embodiments, the request from the TN isolation control function132for status of the active data transport channels may include the isolation policy for the TN NSS and the transport control and management function160may merely report status of active data transport channels that comply with the isolation policy for the TN NSS to the TN isolation control function132. In such a case, the TN isolation control function132may forward all the reported active data transport channels to the TN NSSMF130. The TN NSSMF130may decide a data transport channel (port or VLAN ID) for the TN NSS190in further consideration of for example QoS requirements, security requirements, latency requirements, bandwidth requirements or the like. If necessary, the transport control and management function160may create a new data transport channel in the transport network for the TN NSS190complying with the isolation policy, the QoS requirements, the security requirements, the latency requirements, and the bandwidth requirements responsive to a request from the TN NSSMF130. The transport control and management function160has the capability to create for example a dedicated data transport channel by allocating dedicated physical/virtual routers, dedicated physical/virtual switches and dedicated physical/virtual circuits. The transport control and management function160may be further configured to collect isolation relevant data in the transport network for the TN NSS190and report the data to an isolation monitoring function at a higher layer, for example the TN isolation monitoring function134. Operations of the transport control and management function160will be discussed in detail later.

The TN NSS190connects the AN NSS170at application endpoints172and the CN NSS180at application endpoints182. The TN NSS190may include allocated network resources for example routers such as routers 1-6, switches, ports, VLAN_IDs, and the like for transport of service data between the AN NSS170and the CN NSS180. The allocated network resources may span multiple resource administration domains. For example, as shown inFIG.2, the routers 1, 2, 5 may be in a resource administration domain and the routers 3, 4, 6 may be in another resource administration domain.

In the architecture shown inFIG.2, isolation management/control functions and isolation monitoring functions are provided at both the NS layer and the NSS layer, thereby a fine-grained isolation policy may be supported in E2E network slices. The tenants can monitor enforcement of the isolation policy and, if necessary, update the network slice to correctly fulfill the isolation requirements. A detailed description of support to the fine-grained isolation policy will be given below.

FIG.3illustrates an interaction diagram of operations of network functions for providing isolation in a phase of NSI creation in accordance with some example embodiments. For a better understanding, the below description of interactions shown inFIG.3may be read also with reference toFIG.2. ThoughFIG.3shows interactions relating to network functions in the TN domain, it would be understood that similar interactions may also be applied to network functions in the AN and CN domains.

When the NSMF120receives the request to create a slice and the service profile from the network slice consumer portal110, the isolation management function122at the NS layer may derive210a slice isolation policy from the service profile. For example, the isolation management function122may recognize or identify isolation requirements included in the service profile to obtain or derive the slice isolation policy, and the derived slice isolation policy may be included in the slice profile for the slice to be created. The slice isolation policy is described in an abstract level and can be understood and configured by network slice consumers. The slice isolation policy defined in the E2E slice level is applicable to all domains including AN, CN and TN domains. For example, the slice isolation policy can be “physically isolating network functions (NFs) and connections between NFs of the slice from other slices”, or “logically isolating network functions (NFs) and connections between NFs of the slice from other slices”, or “no isolation”, etc. Physical isolation means that the network slice, including NFs and connections between NFs, should be physically separated from other slices, including for example process and threads isolation, physical memory/storage isolation, and physical network isolation. Logical isolation means that the network slice, including NFs and connections between NFs, should be logically separated from other slices, including for example virtual network resources isolation, virtual network functions isolation, isolation of virtual network links between network functions. No isolation means that the network slice can share network resources with other slices.

The isolation management function122may further break down212the slice isolation policy for the network slice into separate slice isolation policies for an AN NSS, a TN NSS and a CN NSS. Although not shown, the NSMF120may also break down the slice profile into separate AN NSS slice profile, TN NSS slice profile and CN NSS slice profile. The AN NSS isolation policy may be included in the AN NSS slice profile, the TN NSS isolation policy may be included in the TN NSS slice profile, and the CN NSS isolation policy may be included in the CN NSS slice profile.

The isolation management function122may also map214an application type to the slice profile or the NSS slice profiles. The slice profile may include extended information elements (IEs) or attributes to indicate more granular slice and service type (SST), in addition to general SST including eMBB, uRLLC and mMTC. For example, the slice profile may include application level information such as utilities (e.g., gas, water, and electricity), gaming, finance, autonomous driving, etc. Then, the isolation management function122may map an application type to the slice profile or the NSS slice profiles. It would benefit support of fine-grained isolation policy, for example utilities (e.g., gas, water, and electricity) data grouped and forwarded together, gaming data forbidden to be forwarded together with financial data, or the like.

When the NSMF120calls NSSFMs to create NSS instances in respective domains, the NSS slice profiles including NSS isolation policies are also sent to corresponding NSSMFs. Here, operations in the TN domain (including the TN NSSMF130, the TN isolation control function132and the transport control and management function160) are discussed with reference toFIG.3, and operations in the AN domain (including operations of the AN NSSMF140) and the CN domain (including operations of the CN NSSMF150) are not described in detail. It would be appreciated that operations similar to those in the TN domain may also be performed in the AN domain and the CN domain.

Continue referring toFIG.3, the TN isolation control function132at the NSS layer may receive216the TN NSS isolation policy from the isolation management function122at the NS layer, map218the TN NSS isolation policy to network resource isolation policy and traffic isolation policy, and further map220the network resource isolation policy and traffic isolation policy to network resource allocation policy and data traffic forward policy, respectively. An example of the mapping is shown in the below Table 1.

TABLE 1mapping between data forward policy and slice isolation policydata forward policy at data planeslice isolation policy in TN NSS domainNetwork resource allocation policyRouterstandard/undifferentiatedno isolationNetwork resource isolation policydedicated hardwarephysical network function isolationdedicated software/virtuallogical network function isolationSwitchstandard/undifferentiatedno isolationdedicated hardwarephysical network function isolationdedicated software/virtuallogical network function isolationChannelstandard/undifferentiatedno isolationdedicated hardwarephysical network link isolationdedicated software/virtuallogical network link isolationIPsecno IPsecno integrity / confidentialityno isolationIPsec AHdata origin authenticationmedium-level isolation with data origin authentication (security protection level isolation)Data traffic forward policyIPsec ESPdata origin authentication, data integrity, data confidentiality, detection & rejection of replayshigh-level isolation with integrity & confidentiality protection (security protection level isolation)Traffic isolation policyFilter rulesACL -white listdata from specific list of VLAN_IDs to be forwardeddata type 1, data type 3, ...data type 1: bank service, data type 3: finance service, data type 15: gaming service, ... data type 1 and data type 3 could be grouped and transported over one VLAN_ID, over which data type 15 could not be forwarded (data type isolation)ACL -black listdata from specific list of VLAN_IDs to be droppeddata type 15, ...other rules.........DSCP classes [IETF RFC 4594]DF (CS0)standardno isolationAF21, AF22, AF23low-latency datauRLLC data (Service type isolation)AF11, AF12, AF13high-throughput dataeMBB data (Service type isolation)CS1low-priority datamMTC data (Service type isolation)CS4real-time interactivereal-time interactive video conference data (Video type isolation)CS3broadcast videobroadcast video data (Video type isolation)AF31, AF32, AF33multimedia streamingmultimedia streaming data on demand (Video type isolation).........

The TN NSS isolation policy received from the isolation management function122may include a high level isolation requirement for the TN NSS. For example, it may designate only an isolation level defined by Global System for Mobile communication Assembly (GSMA) such as physical isolation, logical isolation or no isolation. At Operation218, the TN NSS isolation policy may be mapped to fine-grained slice isolation policy including the network resource isolation policy and the traffic isolation policy in consideration of the extended attributes in the TN NSS slice profile. The Network resource isolation policy and traffic isolation policy are TN domain specific policies which are TN technology agnostic. They are derived from the slice isolation policy in the TN domain and will be translated to network resource allocation policy and data traffic forward policy, which will be discussed later. The network resource isolation policy may be used to guide the transport control & management function160(e.g., SDN controller, SDN orchestrator or network controller) to deploy and isolate transport devices and the relevant policy may include for example no isolation, physical network function isolation, logical network function isolation, physical network link isolation, logical/virtual network link isolation, and the like. The traffic isolation policy may be used to guide the transport control & management function160to configure transport devices to realize traffic separation/isolation and relevant policy may include for example no isolation, service type isolation, data type isolation, video type isolation, security protection level isolation, and the like.

An example of the network resource isolation policy and the traffic isolation policy is shown in the above Table 1. Referring to Table 1, the network resource isolation policy includes attributes such as no isolation, physical network function isolation and logical network function isolation, physical network link isolation, logical network function, and the traffic isolation policy includes attributes such as no isolation, service type isolation, data type isolation, video type isolation, security protection level isolation (e.g., medium-level isolation with data origin authentication, high-level isolation with integrity and confidentiality protection), and the like. For example, according to security requirements specified in the TN NSS slice profile, the TN NSS isolation policy may be mapped to one of no isolation, service type isolation, data type isolation, video type isolation, service type isolation, data type isolation, video type isolation, security protection level isolation (e.g., medium-level isolation with data origin authentication and high-level isolation with integrity & confidentiality protection) in the traffic isolation policy. Based on data type, isolation rules for the data transportation may be determined. For example, the bank service data and the finance service data could be grouped and transported over one VLAN ID, while gaming service data should not be transported over the VLAN ID. Based on the service type, isolation for uRLLC data, isolation for eMBB data, isolation for mMTC data or no isolation may be applied in the traffic isolation policy. Based on the video type, isolation for real-time interactive video conference data, isolation for broadcast video data or isolation for multimedia streaming data on demand may be applied in the traffic isolation policy. It would be appreciated that different or more attributes may be defined in the network resource isolation policy and the traffic isolation policy.

At Operation220, the network resource isolation policy is mapped to the network resource allocation policy, and the traffic isolation policy is mapped to the data traffic forward policy. The network resource allocation policy and data traffic forward policy are TN specific policies especially for IP networks, and the policies shall be interpreted by transport control & management function (including for example SDN orchestrator, SDN controller or network controller) and finally used to allocate and configure the network devices. For example, the network resource allocation policy may comprise standard/undifferentiated isolation, dedicated hardware for transport network resources such as routers, switches and channels, dedicated software for transport network resources such as routers, switches and channels, logical isolated virtual transport network resources such as routers, switches and channels, etc. The data traffic forward policy may comprise for example standard/undifferentiated isolation, IPSec related rules, access control/filter rules, DSCP (Differentiated Services Code Point) rules, forward rules in flow table, and the like. The IPsec rules may include for example no IPsec, IPsec authentication header (AH), and IPsec encapsulating security payload (ESP). AH and ESP are two protocols defined by the IETF. The AH protocol provides a mechanism for authentication only, and the ESP protocol provides data confidentiality and data authentication (integrity, origin authentication, and replay protection). The filter rules may include for example access control list (ACL) - white list and ACL - black list. For example, data from VLAN IDs in the ACL - white list would be forwarded, while data from VLAN IDs in the ACL - black list would be dropped. The DSCP rules (Differentiated Services Code Point) are defined in IETF RFC4594to identify priority of service data. As shown in Table 1, data type, service type and video type may be mapped to corresponding DSCP classes. Although not shown in Table 1, the forward rules in flow table may define data traffic forwarding rules in OpenFlow Logical Switches. The flow table may contain a set of flow entries comprising fields such as match fields, priority, counters, instructions, etc. Based on service type isolation, for example, uRLLC applications with low latency and high reliability could be classified into the high priority of a flow entry in the flow table, while mMTC applications could be classified into the low priority of a flow entry in the flow table. It would be appreciated that the above-mentioned data traffic forward rules are described as examples, and different or additional rules may also be defined and applied as the data traffic forward policy.

It would be understood that by the two level mappings at Operations218,220, fine-grained isolation policy for the TN domain is established and corresponding network resource allocation requirements and data traffic forward requirements are determined for the TN domain. By applying the network resource allocation requirements and data traffic forward requirements for creation of the TN NSS190, fine-grained isolation would be well supported in the TN NSS190.

Continue referring toFIG.3, the TN isolation control function132may receive222status of resources for example data transport channels represented by ports or VLAN IDs in the transport network from the transport control & management function160, and determine224data transport channels that comply with the network resource allocation policy and the data traffic forward policy based on the status of the data transport channels. The determined data transport channels may be notified226to the TN NSSMF130for creation of the TN NSS190. In some embodiments, the transport control and management function160may periodically and actively report status of active data transport channels to the TN isolation control function132, or in some embodiments the transport control and management function160may report status of active data transport channels to the TN isolation control function132in response to a request from the TN isolation control function132for status of the active data transport channels. The TN isolation control function132may select one or more of the reported data transport channels that comply with the network resource allocation policy and the data traffic forward policy for the TN NSS190and notify the TN NSSMF130of the selected one or more data transport channels. In some embodiments, the request from the TN isolation control function132for status of the active data transport channels may further include the network resource allocation policy and the data traffic forward policy for the TN NSS190and the transport control and management function160may merely report status of active data transport channels that comply with the network resource allocation policy and the data traffic forward policy for the TN NSS190to the TN isolation control function132. In such a case, the TN isolation control function132may select all the reported active data transport channels and forward them to the TN NSSMF130. Then, the TN isolation control function132may assist228the TN NSSMF130to create the TN NSS190according to the network resource isolation policy and the traffic isolation policy. The TN NSS190may have Single-Network Slice Selection Assistance Information (S-NSSAI) to uniquely identify the network slice. In Operation228, the TN NSSMF130may further determine a data transport channel represented by a port or VLAN ID for the TN NSS190in further consideration of for example QoS requirements, security requirements, latency requirements, bandwidth requirements and other factors and map the TN NSS190(for example, the S-NSSAI) to the port or VLAN ID. If one or more of the data transport channels reported from the TN isolation control function132also comply with for example the QoS requirements, the security requirements, the latency requirements, the bandwidth requirements and/or other requirements for the TN NSS190, the TN NSSMF130may select and reuse at least one data transport channel from the one or more of the data transport channels reported from the TN isolation control function132and map the TN NSS190to the selected/reused data transport channel. If none of the data transport channels reported from the TN isolation control function132complies with the QoS requirements, the security requirements, the latency requirements, the bandwidth requirements and other requirements for the TN NSS190, the TN NSSMF130may send a request for creating a data transport channel to the transport control & management function160along with the isolation policy (including the network resource allocation policy and the data traffic forward policy), the QoS requirements, the security requirements, the latency requirements, the bandwidth requirements and the like. Then, the transport control & management function160may create236a new data transport channel for the TN NSS190complying with the isolation policy, the QoS requirements, the security requirements, the latency requirements and the bandwidth requirements. For example, when a tenant requests to create an E2E network slice with physical or logical isolation, the transport control & management function160would create a dedicated data transport channel with allocating dedicated physical or virtual routers, dedicated physical or virtual switches, and dedicated physical or virtual links. The TN NSSMF130may map the TN NSS190to the created data transport channel. The TN isolation control function132may also assist the TN NSSMF130to manage the mapping between the S-NSSAI and the port/VLAN ID together with attributes shown in the above Table 1.

In some embodiments, the TN isolation control function132may check230if the TN slice isolation policy for the TN NSS190, including the network resource isolation policy and the traffic isolation policy, has contradiction with other network slices or network slice subnets that share the same isolation policy. If yes, the TN isolation control function132may update232the TN NSS190with new resource allocation policy and/or data traffic forward policy to remove the contradiction. For example, an existing slice for a bank service is mapped to a VLAN ID x, and a new slice for a gaming service decides to reuse the slice isolation for the existing slice, but the VLAN ID x does not allow simultaneous transport of bank data and gaming data. Then, the TN isolation control function132may select or create a new VLAN ID for the new slice.

The TN NSSMF130may send234the mapping between the TN NSS190and the data transport channel to the transport control & management function160. The transport control & management function160may configure edge routers according to the mapping relationship between the TN NSSs and the data transport channels to prevent data of other slices from being transported through the dedicated physical or virtual data transport channel allocated for the TN NSS190.

Here some examples of TN NSSs with a corresponding isolation policy will be described.

A uRLLC NS consumer C1 requests to create a network slice with physical isolation. Consequently, S-NSSAI-1 is created for this NS consumer. For the TN NSS domain, TN-NSS-1 is created with allocating dedicated hardware routers, switches and physical circuits. The corresponding incoming data of S-NSSAI-1 will be transported over port_1/device_1 of TN-NSS-1 with low-latency data transport, data origin authentication, data integrity protection and confidentiality protection.

An eMBB NS consumer C2 requests to create a network slice with logical isolation. The S-NSSAI-2 is created for this NS consumer. For the TN NSS domain, TN-NSSI-2 is created with allocating dedicated software routers, switches and virtual data transport channels. The corresponding incoming data of S-NSSAI-2 will be transported over VLAN_ID-2 of TN-NSS-2 with high-throughput data transport, data origin authentication. The channel VLAN_ID-2 of TN-NSS-2 is configured to transport financial data, but for example gaming data is forbidden to be transported over the channel VLAN_ID-2.

An mMTC NS consumer C3 requests to create a network slice without isolation requirements. The S-NSSAI-3 is created for this NS consumer. For the TN NSS domain, TN-NSS-3 may be created with allocating standard network resources (e.g., standard routers, standard switches, and standard data transport channels). The corresponding incoming data of S-NSSAI-3 will be transported over VLAN_ID-3 of TN-NSS-3 with standard data transport policy.

A gaming service provider NS Consumer C4 request to create a network slice with logical isolation. It is assumed that the TN-NSS-1, TN-NSS-2, TN-NSS-3 have been created. The NSMF120breaks down this request and calls AN/TN/CN NSS management functions separately to create network slice subnets. The NSMF120also breaks down E2E network slice isolation policy to separate slice isolation policy for each NSS.

The TN isolation control function132of the TN NSS domain receives the TN NSS isolation policy and further breaks down the TN NSS isolation policy to network resource isolation policy and traffic isolation policy. The TN isolation control function132also maps the network resource isolation policy and traffic isolation policy to network resource allocation policy and data traffic forward policy, respectively. For example, the network resource allocation policy is obtained as follows: dedicated software routers, dedicated software switches, dedicated virtual channel; and the data traffic forward policy is obtained as follows: high throughput data, real-time interactive video conference data, no data integrity/confidentiality, no data origin authentication.

It is assumed that the network slice identification for the requested gaming service provider is S-NSSAI_30. With assistance of the TN isolation control function132, the TN NSSMF130decides to reuse TN-NSS-2 according to the obtained network resource isolation policy. However, VLAN_ID-2 of TN-NSS-2 is configured so that gaming data is forbidden and could not be reused to transport data for S-NSSAI_30. Consequently, VLAN_ID-8 of TN-NSS-2 is created and applied to transport data for S-NSSAI_30.

With assistance of the TN isolation control function132, the TN NSSMF130and/or the transport control & management function160configure data transport channel according to the obtained network resource allocation policy and the data traffic forward policy, i.e., incoming data of S-NSSAI_30 will be transported over VLAN_ID-8 of TN-NSS-2.

The mapping between S-NSSAI and port/VLAN_ID for Examples 1-4 is shown in Table 2.

FIG.4illustrates an interaction diagram of operations of network functions for monitoring isolation in a phase of NSI running in accordance with some example embodiments. For a better understanding, the below description of interactions shown inFIG.4may be read also with reference toFIGS.2-3. ThoughFIG.4shows interactions relating to network functions in the TN domain, it would be understood that similar interactions may also be applied to network functions in the AN and CN domains.

When the network slice, including the AN NSS170, the TN NSS190and the CN NSS180, is created and operates to provide services for the tenants, the tenants can monitor operation of the network slice to check if the slice isolation policy is correctly enforced through isolation monitoring functions deployed at the NS layer and the NSS layer as shown inFIG.2. In some embodiments, the isolation monitoring function124at the NS layer may send310a request for collecting isolation monitoring data to respective domain isolation monitoring functions at the NSS layer, including the TN isolation monitoring function134. Responsive to the request received from the isolation monitoring function124, the TN isolation monitoring function134may send312a request for collecting isolation monitoring data to the transport control and management function160. In some embodiments, the TN isolation monitoring function134may periodically send312the request for collecting isolation monitoring data to the transport control and management function160, and the operation310may be omitted.

Responsive to the request from the TN isolation monitoring function134, the transport control and management function160may collect314isolation monitoring data from the transport network. The transport control and management function160may collect isolation relevant data from routers, switches, ports, VLAN IDs, channels allocated to the TN NSS190. For example, the transport control and management function160may monitor if data traffic of a particular service is transported via the allocated network resources, or if the allocated network resources further transport additional service data. Then, the transport control and management function160may report316the collected isolation monitoring data to the TN isolation monitoring function134. In some embodiments, the TN isolation monitoring function134may also collect isolation monitoring data from the TN NSSMF130(not shown inFIG.4).

The TN isolation monitoring function134may analyze318the isolation monitoring data to determine if the slice isolation policy for the TN NSS190is satisfied during operation of the TN NSS190. For example, the TN isolation monitoring function134may check if attributes shown in Table 2 for a TN NSS are correctly enforced. Then, the TN isolation monitoring function134may report322isolation monitoring information including the analysis results or together with the original isolation monitoring data to an isolation monitoring function at a higher layer, for example the isolation monitoring function124at the NS layer. In some embodiments, if it is determined that the slice isolation policy for the TN NSS190is not fulfilled, the TN isolation monitoring function134may trigger320updating of the TN NSS190to comply with the TN slice isolation policy. For example, if the TN isolation monitoring function134finds that bank service data and gaming service data are transported via the same VLAN ID while the slice isolation policy for the bank service slice specifies that the bank service data should be isolated from gaming service data, the TN isolation monitoring function134may trigger updating of the bank service slice, and the TN isolation control function132may assist the TN NSSMF130to reconfigure or create a new VLAN ID for the bank service slice. In some embodiments, the operation320may be performed at a higher layer, for example by the isolation monitoring function124.

It would be appreciated that, in addition to the isolation monitoring information from the TN isolation monitoring function134, the NS isolation monitoring function124may also receive isolation monitoring information from the AN domain and the CN domain. Then, the NS isolation monitoring function124may determine324if the slice isolation policy is properly enforced during operation of the NSSs. As discussed above, the isolation monitoring information comprises analysis results of isolation monitoring data with respect to fine-grained attributes such as those shown in Tables 1-2 that are refined from the slice isolation policy by the NS isolation management function122. Therefore, the example embodiments can achieve fine control, management and monitoring of the slice isolation policy.

If the NS isolation monitoring function124determines that the slice isolation policy is not properly enforced in the network slice, it may generate326an alarm to inform the tenant or network operator of an isolation violation event. In some embodiments, the NS isolation monitoring function124may also trigger updating of the slice to comply with the slice isolation policy.

FIG.5illustrates a flow chart of a method400for isolation of a network slice in accordance with some example embodiments. The method400may be performed for example at a network function unit such as the TN isolation control function132.

As shown inFIG.5, the example method400may include a step410of receiving slice isolation policy for a NSS in a TN domain, a step420of mapping the slice isolation policy to network resource isolation policy and traffic isolation policy, and a step430of mapping the network resource isolation policy and the traffic isolation policy to network resource allocation policy and data traffic forward policy, respectively. The network resource allocation policy and the data traffic forward policy may be applied to creation of the TN NSS.

The slice isolation policy for a NSS in a TN domain may be for example the isolation policy for the TN NSS190. During creation of the TN NSS190, the NSMF120or the isolation management function122therein may send the isolation policy for the TN NSS190to the TN NSSMF130or the TN isolation control function132. In the step420and the step430, two level mapping is performed on the slice isolation policy for the TN NSS so that fine-grained network resource isolation policy, traffic isolation policy, network resource allocation policy and data traffic forward policy are obtained for the TN NSS, of which an example is shown in the above Table 1. The network resource allocation policy and the data traffic forward policy are applied to create the TN NSS190.

In some embodiments, the network resource isolation policy may include one or more of following attributes: no isolation, physical network function isolation, logical network function isolation, physical network link isolation, logical/virtual network link isolation, etc. The traffic isolation policy may include one or more of following attributes: no isolation, service type isolation, data type isolation, video type isolation, security protection level isolation, and so on. The service type isolation may include for example uRLLC service, eMBB service, mMTC service and the like. The data type isolation may include for example bank data, finance data, gaming data, smart grid data, logistics data, and the like. The video type isolation may include for example real-time interactive video conference data, broadcast video data, multimedia streaming data on demand, and the like. The security protection level isolation may include for example medium-level isolation with data origin authentication, high-level isolation with integrity and confidentiality protection, and so on.

In some embodiments, the method400may optionally include a step440of obtaining status of resources in the transport network, a step450of determining resources in the transport network that comply with the network resource allocation policy and the data traffic forward policy based on the obtained status of resources in the transport network, and a step460of notifying the determined resources in the transport network to an NSS management function in the TN domain for creation of the TN NSS.

In the step440, the TN isolation control function132may obtain status of data transport channels in the transport network from the transport control & management function160. In the step450, the TN isolation control function132may select data transport channels that comply with the network resource allocation policy and the data traffic forward policy based on the status of the data transport channels. When the determined/selected data transport channels are notified to the TN NSSMF130, the TN NSSFM130may decide the data transport channel (port/VLAN ID) for the TN slice subnet to be created in further consideration of for example security, QoS or additional requirements. For example, if the selected data transport channels also comply with the security requirements, the latency requirements, the bandwidth requirements and the QoS requirements for the TN NSS to be created, the TN NSSFM130may map the TN NSS to at least one of the selected data transport channels. On the other hand, if none of the selected data transport channels complies with the security requirements and the QoS requirements for the TN NSS to be created, the TN NSSFM130may request the transport control & management function160to create a new data transport channel complying with the network resource allocation policy, the data traffic forward policy, the latency requirements, the bandwidth requirements, the security requirements and the QoS requirements, and map the TN NSS to the created data transport channel.

In some embodiments, the method400may optionally include a step470of checking if the slice isolation policy for the TN NSS190has contradiction with other network slices or NSSs when the slice isolation policy is shared by the TN NSS190and the other network slices or NSSs and a step480of updating the TN NSS190with new resource allocation policy and/or data traffic forward policy to remove the contradiction.

FIG.6illustrates a block diagram of an apparatus500in accordance with some example embodiments. The apparatus may be implemented in for example the TN isolation control function132to perform the method400shown inFIG.5. Referring toFIG.6, the apparatus500may include a first means (or module)510for performing the step410of the method400, a second means520for performing the step420of the method400, and a third means530for performing the step430of the method400. Optionally, the apparatus500may further include a fourth means540for performing the step440of the method400, a fifth means550for performing the step450of the method400, a sixth means560for performing the step460of the method400, a seventh means570for performing the step470of the method400, and an eighth means580for performing the step480of the method400.

FIG.7illustrates a flow chart of a method600for isolation of a network slice in accordance with some example embodiments. The method600may be performed for example in a network function unit such as the transport control and management function160shown inFIG.2.

Referring toFIG.7, the method600may include a step610of creating a data transport channel for a NSS in a TN complying with isolation policy for the TN NSS, a step620of collecting isolation relevant data of the TN NSS during operation of the TN NSS, and a step630of reporting the collected isolation relevant data to an isolation monitoring function at a higher layer.

In the step610, the transport control and management function160may create the data transport channel for the TN NSS190in response to a request from the TN NSSMF130. For example, when none of the existing data transport channel satisfies requirements of the TN NSS190including for example the isolation policy, the QoS requirements, the security requirements, the latency requirements and the bandwidth requirement, the TN NSSMF130may request the transport control and management function160to create a new data transport channel for the TN NSS190. The transport control and management function160may create the new data transport channel for the TN NSS190by allocating network resources such as routers, switches and the like for the TN NSS190. For example, a dedicated physical or logical data transport channel for the TN NSS190may be created by allocating dedicated physical or logical router, dedicated physical or logical switches and dedicated physical or logical circuits.

In the step620, isolation relevant data of the TN NSS190may be collected during operation of the TN NSS190. The isolation relevant data may be collected from for example network resources such as routers and switches allocated to the TN NSS190or from apparatus controlling or managing the network resources allocated to the TN NSS190. In the step630, the collected isolation relevant data may be reported to an isolation monitoring function at a higher layer, for example the TN isolation monitoring function134at the NSS layer or the isolation monitoring function124at the NS layer.

FIG.8illustrates a block diagram of an apparatus700in accordance with some example embodiments. The apparatus may be implemented in for example the transport control and management function160to perform the method600shown inFIG.7. Referring toFIG.8, the apparatus700may include a first means (or module)710for performing the step610of the method600, a second means720for performing the step620of the method600, and a third means730for performing the step630of the method600.

FIG.9illustrates a flow chart of a method800for monitoring isolation of a network slice in accordance with some example embodiments. The method800may be performed for example in a network function unit such as the TN isolation monitoring function134.

Referring toFIG.9, the method800may include a step810of sending a request of collecting isolation monitoring data for a NSS to a transport control and management function of a TN, a step820of receiving the isolation monitoring data for the TN NSS190from the transport control and management function, a step830of analyzing the isolation monitoring data to determine if slice isolation policy for the TN NSS190is satisfied during operation of the TN NSS190, and a step840of reporting the analysis result of the isolation monitoring data to an isolation monitoring function at a higher layer.

For example, during operation of the TN NSS190, the TN isolation monitoring function134may send810the request of collecting isolation monitoring data to for example the transport control and management function160. The request may be sent periodically or responsive to an instruction from a higher layer, for example from the isolation monitoring function124at the NS layer. Then, the TN isolation monitoring function134may receive820the isolation monitoring data for the TN NSS190from the transport control and management function160and analysis830the isolation monitoring data to determine if the slice isolation policy for the TN NSS190is satisfied during operation of the TN NSS190. In some embodiments, the TN isolation monitoring function134may also receive the isolation monitoring data for the TN NSS190from at least one management function of the TN NSS190such as the TN NSSMF130. In the step840, the analysis results of the isolation monitoring data, or together with the original isolation monitoring data, are reported to for example the isolation monitoring function124at the NS layer.

In some embodiments, the method800may optionally include a step850of receiving isolation monitoring data from at least one management function of the TN NSS190, for example the TN NSSMF130, and a step860of triggering updating of the TN NSS190to comply with the slice isolation policy for the TN NSS190when it is determined that the slice isolation policy for the TN NSS190is not satisfied during operation of the TN NSS190in the step830. For example, the TN NSS190may be reconfigured or allocated with new resources to comply with the isolation policy.

FIG.10illustrates a block diagram of an apparatus900in accordance with some example embodiments. The apparatus may be implemented in for example the TN isolation monitoring function134to perform the method800shown inFIG.9. Referring toFIG.10, the apparatus900may include a first means (or module)910for performing the step810of the method800, a second means920for performing the step820of the method800, a third means930for performing the step830of the method800, and a fourth means940for performing the step840of the method800. Optionally, the apparatus900may include a fifth means950for performing the step850of the method800, and a sixth means960for performing the step860of the method800.

FIG.11illustrates a flow chart of a method1000for monitoring isolation of a network slice in accordance with some embodiments. The method1000may be performed for example in a network function unit such as the isolation monitoring function124shown inFIG.2.

Referring toFIG.11, the method1000may include a step1010of receiving isolation monitoring information for a NSS of a NS, a step1020of determining if slice isolation policy is properly enforced during operation of the NSS based on the received isolation monitoring information, and a step1030of generating an alarm when it is determined that at least a part of the slice isolation policy is not properly enforced.

For example, during operation of a network slice, the isolation monitoring information for a NSS of the network slice may be received from a domain isolation monitoring function such as the TN isolation monitoring function134and/or isolation monitoring functions deployed in the AN and CN domains. In some embodiments, the isolation monitoring information may be received from the domain isolation monitoring function for the NSS periodically or responsive to a request for the isolation monitoring information sent from the isolation monitoring function124to the domain isolation monitoring function for the NSS. The received isolation monitoring information may include analysis results of isolation monitoring data with respect to attributes of the network resource isolation policy and the traffic isolation policy refined/extended from the slice isolation policy. Examples of the attributes may include those shown in the above Tables 1-2. Optionally the isolation monitoring information may further include the original isolation monitoring data. The isolation monitoring information received in the step1010may include isolation monitoring information for an NSS in an AN domain, isolation monitoring information for a NSS in a TN domain, and isolation monitoring information for a NSS in a CN domain. In the step1020, the isolation monitoring function124determines if slice isolation policy is properly enforced during operation of the NS/NSS based on the received isolation monitoring information. If it is determined that at least a part of the slice isolation policy is not properly enforced, an alarm is generated in the step1030.

FIG.12illustrates a block diagram of an apparatus1100in accordance with some example embodiments. The apparatus may be implemented for example in the isolation monitoring function124to perform the method1000shown inFIG.11. Referring toFIG.12, the apparatus1100may include a first means (or module)1110for performing the step1010of the method1000, a second means1120for performing the step1020of the method1000, and a third means1130for performing the step1030of the method1000.

FIG.13illustrates a block diagram of a network function unit1200in accordance with some example embodiments. The network function unit1200may be implemented as any one of the network functions discussed above to perform the operations and/or methods relating to the network function. In some embodiments, two or more network functions may be implemented together as the network function unit1200. For example, the NS isolation management function and the NS isolation monitoring function, or the TN isolation control function and the TN isolation monitoring function, may be implemented together as the network function unit1200.

Referring toFIG.13, the network function unit1200may include one or more processors1210, one or more memories1220and one or more network interfaces1230interconnected together through one or more buses1240. The one or more buses1240may be address, data, or control buses, and may include any interconnection mechanism such as series of lines on a motherboard or integrated circuit, fiber, optics or other optical communication equipment, and the like. The one or more network interfaces1230are provided to support wired and/or wireless communications with other network functions, elements or nodes. In some embodiments, the one or more network interfaces1230may implement for example NG interfaces or Xn interfaces. The one or more memories1220may include computer program code1222. The one or more memories1220and the computer program code1222may be configured to, when executed by the one or more processors1210, cause the network function unit1200to perform operations and/or methods as described above.

The one or more processors1210may be of any appropriate type that is suitable for the local technical network, and may include one or more of general purpose processors, special purpose processor, microprocessors, a digital signal processor (DSP), one or more processors in a processor based multi-core processor architecture, as well as dedicated processors such as those developed based on Field Programmable Gate Array (FPGA) and Application Specific Integrated Circuit (ASIC). The one or more processors1210may be configured to control other elements of the network function unit and operate in cooperation with them to implement the procedures discussed above.

The one or more memories1220may include at least one storage medium in various forms, such as a volatile memory and/or a non-volatile memory. The volatile memory may include but not limited to for example a random access memory (RAM) or a cache. The non-volatile memory may include but not limited to for example a read only memory (ROM), a hard disk, a flash memory, and the like. Further, the one or more memories1220may include but not limited to an electric, a magnetic, an optical, an electromagnetic, an infrared, or a semiconductor system, apparatus, or device or any combination of the above.

It would be understood that blocks shown in the drawings may be implemented in various manners, including software, hardware, firmware, or any combination thereof. In some embodiments, one or more blocks may be implemented using software and/or firmware, for example, machine-executable instructions stored in the storage medium. In addition to or instead of machine-executable instructions, parts or all of the blocks in the drawings may be implemented, at least in part, by one or more hardware logic components. For example, and without limitation, illustrative types of hardware logic components that can be used include Field-Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application-Specific Standard Products (ASSPs), System-on-Chip systems (SOCs), Complex Programmable Logic Devices (CPLDs), etc.

Some exemplary embodiments further provide computer program code or instructions which, when executed by one or more processors, may cause a device or apparatus to perform the procedures described above. The computer program code for carrying out procedures of the exemplary embodiments may be written in any combination of one or more programming languages. The computer program code may be provided to one or more processors or controllers of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the program code, when executed by the processor or controller, cause the functions/operations specified in the flowcharts and/or block diagrams to be implemented. The program code may execute entirely on a machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.

Although the subject matter has been described in a language that is specific to structural features and/or method actions, it is to be understood the subject matter defined in the appended claims is not limited to the specific features or actions described above. On the contrary, the above-described specific features and actions are disclosed as an example of implementing the claims.