Patent Description:
Security needs to be ensured in various cellular communication systems, such as in <NUM> systems developed by the 3rd Generation Partnership Project, 3GPP. The 3GPP still develops <NUM> systems and there is a need to provide improved methods, apparatuses and computer programs to enhance security in <NUM> systems. Such improvements may be useful in other cellular communication systems as well.

The 3GPP document "<NPL>), studies security enhancements to 5GS that are required to fulfil Stage-I service requirements in vertical domains defined in TS <NUM> and TS <NUM> and addresses the solutions described by TR <NUM> and TR <NUM> studies.

<CIT> presents a method for applying a host security service to a network is described herein. The network may include a host device and a network device. The network device may receive a request for security-based filtering. The request includes filtering parameters that restrict traffic between the host device and the network device. It is determined whether the filtering parameters conflict with an initial filtering configuration. The filtering parameters may be applied to traffic through the network device.

According to some aspects, there is provided the subject-matter of the independent claims. Some example embodiments are defined in the dependent claims.

The scope of protection sought for various example embodiments of the invention is set out by the independent claims. The example embodiments and features, if any, described in this specification that do not fall under the scope of the independent claims are to be interpreted as examples useful for understanding various example embodiments of the invention.

According to a first aspect of the present invention, there is provided an apparatus, comprising means for receiving, by a network function in a cellular communication system, configuration information required to initialize at least one other network function to operate according to a port-based network access control standard and a port-based medium access security standard, wherein the network function is configured to provide time sensitive networking or communications, and the configuration information comprises a storage format of the port-based network access control standard and a storage format of the port-based medium access security standard and means for configuring the at least one other network function to operate according to the port-based network access control standard and the port-based medium access security standard based on the configuration information.

Security of cellular communication systems may be improved by the procedures described herein. More specifically, security of cellular communication systems may be improved by configuring by a Network Function, NF, at least one other NF located in a cellular communication system with configuration information which comprises a storage format, like a Management Information Base, MIB, module, of a port-based network access control standard (such as an Institute of Electrical and Electronics Engineers, IEEE, <NUM>. 1X standard) and a storage format of a port-based medium access security standard (such as a IEEE <NUM>. 1AE standard). The at least one other NF may be configured to operate as a boundary interface to other networks and as a security endpoint, thereby enabling security features at boundary interfaces of the cellular communication system, such as a <NUM> System, 5GS, for secure integration to said other networks.

<FIG> illustrates an exemplary network scenario in accordance with at least some example embodiments. More specifically, <FIG> illustrates integration of a cellular communication system, such as a 5GS, and IEEE <NUM> bridge network using parts of the IEEE Time Sensitive Networking, TSN, toolset. In <FIG> protected (generalized) Precision Time Protocol, PTP, communication (e.g., RFC <NUM> compliant) is denoted with solid lines and unprotected (g)PTP communication (potential attack surface) is denoted with dashed lines. The cellular communication system is denoted by <NUM>. The cellular communication system <NUM> may comprise a Device-Side TSN Translator <NUM>, DS-TT, a User Equipment <NUM>, UE, a Base Station <NUM>, BS, such as a gNB, a User Plane Function, UPF, which may include a Network-Side TSN Translator, NW-TT, <NUM>. The exemplary network scenario of <FIG> also comprises a TSN network <NUM> and the TSN network may further comprise TSN endpoints <NUM>, TSN nodes <NUM> (e.g., TSN bridges and/or TSN switches) and a TSN Grand Master, GM, clock <NUM>. The TSN network <NUM> may be a TSN network standardized by <NUM>rd Generation Partnership Project, 3GPP, in TS <NUM> for example.

The cellular communication system <NUM>, such as a 5GS standardized by 3GPP may be able to integrate into the TSN network <NUM> as a time aware bridge. An ingress interface <NUM> of the cellular communication system <NUM> from the TSN network <NUM> may be the NW-TT <NUM> and an egress interface <NUM> of the cellular communication system <NUM> towards the TSN network <NUM> may be the DS-TT <NUM>. The DS-TT <NUM> and the NW-TT <NUM> may process and forward communications according to mechanisms of the TSN <NUM>. Several protocols may be supported by both, the DS-TT <NUM> and the NW-TT <NUM>. An example is time synchronization (e.g., gPTP as defined in the IEEE <NUM>. 1AS standard, but also PTP as defined in the IEEE <NUM>-<NUM> standard is possible), which has to be achieved to allow TSN integration of the cellular communication system <NUM>.

From the TSN network <NUM> outside of the cellular communication system <NUM>, TSN nodes (such as TSN endstations <NUM> and TSN bridges or switches <NUM>) may be connected to the cellular communication system <NUM> via the DS-TT <NUM> and the NW-TT <NUM>. At least some of the TSN nodes <NUM>, <NUM> may also be connected to each other in the TSN network <NUM>. Since the cellular communication system <NUM> may have similar properties as other TSN bridges/switches <NUM> in the network, several cellular communication systems <NUM> may be connected to each other to form a larger TSN network.

If the DS-TT <NUM> and the NW-TT <NUM> only have security requirements defined, e.g., in the 3GPP SA3, for communication between them inside the cellular communication system <NUM>, but not for ingress and egress communication from and to the TSN network <NUM>, respectively, the communication between the cellular communication system over the DS-TT <NUM> and/or the NW-TT <NUM> and external TSN nodes <NUM>, <NUM> may be unprotected. Unprotected communication in a TSN network may cause severe security risks.

Using time synchronization as an example, a non-compliant cellular communication system may not meet security requirements (defined in RFC <NUM> for example) in a TSN domain and thus be unusable as a TSN bridge or if used pose a security risk to other nodes in the network domain. TSN domains which do not meet mandatory security requirements, e.g., from RFC <NUM>, for time protocols in packet switched networks are vulnerable to:.

The impacts of these attacks comprise system failure due to DoS, accuracy degradation and false times being synchronized. Besides time synchronization, unprotected communication in TSN networks may be subject to manipulation of control messages for production systems (e.g. robots), resulting in compromised systems controls or DoS conditions.

Embodiments of the present invention therefore provide enhanced security mechanisms for cellular communication systems, such as 5GSs. In some embodiments, configuration of security mechanisms at boundary interfaces of the cellular communication system <NUM>, such as DS-TT <NUM>, UE <NUM> and NW-TT <NUM>, is provided. More specifically, in some embodiments, support for a port-based network access control standard, such as the IEEE <NUM>. 1X standard, and a port-based medium access security standard, such as the IEEE <NUM>. 1AE standard, security features at the boundary interfaces of the cellular communication system <NUM> is provided, thereby enabling secure integration of the cellular communication system <NUM> to other networks.

As an example, a new configuration option is introduced by MIB modules in m-plane or c-plane, possibly along with a new Information Object Class, IOC, for a TSN Application Function, AF, for example. Furthermore, a port management information table may be extended to enable exchanging configuration information corresponding to the new configuration option and management of the DS-TT <NUM> and the NW-TT <NUM>. Even though MIBs are used as an example of a storage format (i.e., a database format), embodiments of the present invention may be exploited in case of any storage format. For instance, in case of NETCONF/RESTCONF, the storage format may be a YANG model.

An NF in the cellular communication system <NUM> may receive configuration information required to initialize at least one other NF to operate according to the port-based network access control standard and the port-based medium access security standard, wherein the at least one other NF may be configured to implement the port-based network access control standard and the port-based medium access security standard. The at least one other NF may be the DS-TT <NUM> and/or the NW-TT <NUM> in IEEE TSN scenarios when the NF is a TSN AF. Alternatively, the at least one other NF may be the UE <NUM> and/or the UPF in native TSC scenarios when the NF is an SMF. The at least one other NF may be an NF which is configured to interface the TSN network <NUM> on a user-plane. The configuration information may comprise a MIB module of the port-based network access control standard and a MIB module of the port-based medium access security standard, e.g., the configuration information may be defined using two MIBs, such as IEEE8021X-PAE-MIB and IEEE8021-SECY-MIB. In case of IEEE standards, the configuration information may be referred to as "attributes", however in 3GPP these kind of parameters are referred to as "information".

The NF may be a time sensitive networking application function configured to provide time sensitive networking or communications. For instance, the cellular communication system <NUM> may be configured to operate in a TSN bridge mode and in such a case the NF and the at least one other NF may be able to, and be configured to, transmit and receive Ethernet frames of a TSN flow according to a schedule. As an alternative to the TSN bridge mode, the NF may be a Session Management Function, SMF, configured to operate in a Native Time Sensitive Communication, TSC, mode. Thus, the NF and the at least one other NF may be able to, and be configured to, provide deterministic communication with high reliability and availability.

The NF, such as the TSN AF or the SMF, may receive the configuration information from m-plane via Orchestration & Automation Management, OAM, or from c-plane via a configuring NF, such as Network Exposure Function, NEF, SMF or Central Network Controller, CNC. That is to say, the NF may receive the configuration information from m-plane via OAM or from c-plane from the configuring NF, possibly in an IOC.

The NF, such as the TSN AF or the SMF, may receive the configuration information and also maintain (i.e. store, update) the configuration information locally. Furthermore, the NF may modify the data based on other factors. Then, the NF may forward the configuration information in the port management information container (which may be a different data format than the data was received at the TSN AF/SMF) to the at least one other NFs that implements <NUM>. 1x/AE, i.e. the DS-TT <NUM> and/or the NW-TT <NUM> (IEEE TSN bridge mode) or the UE <NUM> and/or the UPF (native TSC mode). The at least one other NF then initializes and operates <NUM>.

As an example, the NF may be a TSN AF and in such a case the configuration information of the TSN AF with IEEE <NUM>. 1X and IEEE <NUM>. 1AE parameters may be received from OAM via m-plane. The TSN AF may need to be in a Network Resource Model, NRM, of the cellular communication system, e.g., in a <NUM> NRM as defined in the 3GPP standard specification TS <NUM>, in addition to other NFs (e.g., Access and Mobility Function AMF, SMF, etc.).

For the integration of the TSN AF into the NRM of the cellular communication system <NUM>, e.g. integration into the 3GPP standard specification TS <NUM>, the following steps may need to be considered:.

Moreover, in some embodiments, the NF may transmit the configuration information to at least one other NF located in the cellular communication system <NUM>. Said at least one other NF may be configured to operate as a boundary interface to other networks and as a security endpoint (e.g., the Port Access Entity, PAE, terminating MACsec Key Agreement, MKA, protocol and MACsec secured channel). Said at least one other NF may be an NF that implements the port-based network access control standard (e.g., the IEEE <NUM>. 1X standard) and the port-based medium access security standard (e.g., the IEEE <NUM>. 1AE standard). Upon receiving the configuration information, said at least one other NF may configure itself to operate according to the port-based network control standard and the port-based medium access security standard based on the configuration information. In embodiments of the present invention, operating according to the port-based network control standard and the port-based medium access security standard means performing cryptographic operations on received data and data to be send (e.g. encrypting and decrypting) according to the port-based network control standard and the port-based medium access security standard based on the configuration information. In addition, operate may refer to performing operations to facilitate the cryptographic operation (e.g. maintaining timers and other local data).

An example is the integration of the cellular communication system <NUM>, such as 5GS, as an IEEE TSN bridge. In this scenario, said at least one other NF may comprise the DS-TT <NUM> and the NW-TT <NUM> which may be the interfaces connecting the cellular communication system <NUM> to the TSN network <NUM>. In order to provide protection on OSI layer <NUM> (Ethernet frames) including time synchronization protocols, such as gPTP time sync frames, configuration and management information may be transmitted to said at least one other NF, i.e., to the DS-TT <NUM> and NW-TT <NUM>, or the UE <NUM> and the UPF.

Said at least one other NF, such as the DS-TT <NUM> and NW-TT <NUM> or the UE <NUM> and the UPF, may be configured from the NF, e.g., from the TSN AF, via a port management information container. For instance, the NF may transmit the configuration information to said at least one other NF in a port management information table.

As an example, to provide the configuration information to the DS-TT <NUM> and/or the NW-TT <NUM>, the port management information table, as defined in the 3GPP standard specification TS <NUM>, section <NUM>, for example, may be extended to include a minimal set of parameters, i.e., the required set, for the <NUM>. 1X MIB (IEEE8021X-PAE-MIB) and the <NUM>. 1AE MIB (IEEE8021-SECY-MIB). The port management information container may be used to transparently configure and manage the DS-TT <NUM> and the NW-TT <NUM> from the NF, such as the TSN AF. The port management information container may be used to transport the port management information table, but in terms of content there may be no difference.

It should be noted that IEEE <NUM>. 1X and IEEE <NUM>. 1AE MIBs are port-specific and thus, a bridge management information table cannot be used as an alternative to the port management information table. Moreover, at least in case of <NUM>, 5GS bridge ports at the DS-TT <NUM> and the NW-TT <NUM> may need to operate in supplicant and authenticator modes, respectively.

Another example is the usage of IEEE <NUM>. 1X and <NUM>. 1AE in a Native TSC scenario. The native TSC scenario may refer to a scenario, wherein the cellular communication system is not used as a IEEE TSN bridge. In this scenario, the boundary interfaces may be located at the UE <NUM> and the UPF. Thus management and configuration information may need to be provided to both, the UE <NUM> and the UPF, by the NF. In this case, the NF may be an SMF and the SMF may provide the configuration information instead of the TSN AF. Consequently, the SMF IOC may be extended to include both MIBs, i.e., the MIB of the IEEE <NUM>. 1X and the MIB of the IEEE <NUM>. If the SMF provides the configuration information to the UE <NUM>, the SMF may also configure the UPF for endpoint termination of a secured channel. A major advantage of this more general approach is that, if the cellular communication system is not used as a TSN bridge (i.e. Native TSC), the secured channels can still be configured and operated. It should be noted that if the UE <NUM> is used as a security endpoint, the cellular communication system <NUM> may not operate as a TSN bridge, because the DS-TT <NUM> cannot access and process information encrypted in the secured channel terminated only after traversing the DS-TT <NUM>.

<FIG> illustrate flow charts of a first scenario in accordance with at least some example embodiments. In the scenario shown in <FIG> the cellular communication system <NUM> (i.e., the DS-TT <NUM> and/or the NW-TT <NUM>) may communicate with a TSN node, such as the TSN endstation <NUM>. The TSN endstation <NUM> may be limited to a supplicant functionality while the cellular communication system <NUM> (i.e., the DS-TT <NUM> and/or the NW-TT <NUM>) may be configured to provide an authenticator functionality. The authentication server <NUM> may be an entity in the TSN network <NUM> but not in the cellular communication system <NUM>, such as the 5GS. While possibly being an additional functionality that the cellular communication system <NUM> may provide to the TSN network <NUM>, the case with the authentication server <NUM> already existing in the TSN network <NUM> is considered. This is already a prerequisite from IEEE <NUM>. 1X and IEEE <NUM>. 1AE for the protection mechanisms to function properly. Thus, the cellular communication system <NUM> (i.e., the DS-TT <NUM> and/or the NW-TT <NUM>) may assume that the authentication server <NUM> is available. The DS-TT <NUM> and/or the NW-TT <NUM> may directly contact the authentication server <NUM> for identity verification of the supplicant (i.e., the TSN endpoint <NUM>, like an IEEE TSN node configured to operate in <NUM>. 1X supplicant mode) via the RADIUS/DIAMETER protocol (as already supported in the 3GPP standard specification TS <NUM> clause <NUM> and detailed in the 3GPP standard specification TS <NUM>). A network address of the authentication server <NUM> may be a part of the configuration information and thus known to the DS-TT <NUM> and/or the NW-TT <NUM>.

<FIG> illustrate flow charts of a second scenario in accordance with at least some example embodiments. In the scenario shown in <FIG>, the cellular communication system <NUM> (i.e., the DS-TT <NUM> and/or the NW-TT <NUM>) may communicate with a TSN node <NUM> which has authenticator capabilities. In <FIG> the TSN node <NUM> is a TSN bridge and in <FIG> the TSN node <NUM> is a TSN switch. As the TSN node <NUM> has authenticator capabilities, the cellular communication system <NUM> (i.e., the DS-TT <NUM> and/or the NW-TT <NUM>) may be able to operate in the supplicant mode. Procedure shown in <FIG> is otherwise the same as the procedure shown in <FIG>, but the difference is that in the scenario of <FIG> the DS-TT <NUM> and/or the NW-TT <NUM> may provide authentication information via EAPoL to the TSN node <NUM> (TSN bridge or the TSN switch) and the TSN node <NUM> may verify the identity with the authentication server <NUM> via RADIUS/DIAMETER as described in the IEEE <NUM>. 1X standard.

In some embodiments, an IEEE <NUM>. 1X MIB may comprise at least one of the following parameter groups that may need to be configured to the NF, such as the TSN AF, the DS-TT <NUM> and the NW-TT <NUM>: PAE System, NID, PAE, LogonNIDs, Announcer, Eapol Statistics, KaY, Authenticator, Supplicant, LogonProcess, SessionStatistics, Participants, Listener, Announce and Announcement.

In some embodiments, an IEEE <NUM>. 1AE MIB may comprise at least one of the following parameter groups that may need to be configured to the NF, such as the TSN AF, the DS-TT <NUM> and the NW-TT <NUM>: SecYSystem, SecY, Verification, Used_Interface, CipherSuite, CipherSuiteControl, CurrentCipherSuite, TransmitSC, Generation, ReceiveSC, Data_key, TransmitSA, TrafficClass, ReceiveSA and Provided_Interface.

In some embodiments, the configuration information may be integrated into the 3GPP standard specifications TS <NUM> and TS <NUM>, clause <NUM> (TSN bridge mode). While not being part of the current 3GPP specifications, the IOC for the NF, such as the TSN AF, may be designed in the same way as IOCs for already existing NFs defined in the 3GPP standard specification TS <NUM>. In the table below, an example of the IOC table for the NF is given, wherein the attribute "Minimal Sec-MIB" has been added.

In some embodiments, the configuration information may be integrated into the 3GPP standard specifications in the 3GPP standard specification TS <NUM>, clause <NUM>. In the table below an exemplary excerpt of a section of the table is given.

<FIG> illustrates an example apparatus capable of supporting at least some example embodiments. Illustrated is device <NUM>, which may comprise, for example, the NF or the at least one other NF, or a device controlling functioning thereof. Comprised in device <NUM> is processor <NUM>, which may comprise, for example, a single- or multi-core processor wherein a single-core processor comprises one processing core and a multi-core processor comprises more than one processing core. Processor <NUM> may comprise, in general, a control device. Processor <NUM> may comprise more than one processor. Processor <NUM> may be a control device. Processor <NUM> may comprise at least one Application-Specific Integrated Circuit, ASIC. Processor <NUM> may comprise at least one Field-Programmable Gate Array, FPGA. Processor <NUM> may comprise an Intel Xeon processor for example. Processor <NUM> may be means for performing method steps in device <NUM>, such as determining, causing transmitting and causing receiving. Processor <NUM> may be configured, at least in part by computer instructions, to perform actions.

A processor may comprise circuitry, or be constituted as circuitry or circuitries, the circuitry or circuitries being configured to perform phases of methods in accordance with example embodiments described herein. As used in this application, the term "circuitry" may refer to one or more or all of the following: (a) hardware-only circuit implementations, such as implementations in only analog and/or digital circuitry, and (b) combinations of hardware circuits and software, such as, as applicable: (i) a combination of analog and/or digital hardware circuit(s) with software/firmware and (ii) any portions of hardware processor(s) with software (including digital signal processor(s)), software, and memory(ies) that work together to cause an apparatus, such as a network function, to perform various functions) and (c) hardware circuit(s) and or processor(s), such as a microprocessor(s) or a portion of a microprocessor(s), that requires software (e.g., firmware) for operation, but the software may not be present when it is not needed for operation.

Device <NUM> may comprise a transmitter <NUM>. Device <NUM> may comprise a receiver <NUM>. Transmitter <NUM> and receiver <NUM> may be configured to transmit and receive, respectively, information in accordance with at least one cellular standard, such as a standard defined by the 3GPP. Transmitter <NUM> may comprise more than one transmitter. Receiver <NUM> may comprise more than one receiver. Transmitter <NUM> and/or receiver <NUM> may be configured to operate in accordance with a suitable communication standard.

Device <NUM> may comprise User Interface, UI, <NUM>. UI <NUM> may comprise at least one of a display, a keyboard, a touchscreen, a vibrator arranged to signal to a user by causing device <NUM> to vibrate, a speaker and a microphone. A user may be able to operate device <NUM> via UI <NUM>, for example to configure device <NUM> and/or functions it runs.

Device <NUM> may comprise further devices not illustrated in <FIG>. In some example embodiments, device <NUM> lacks at least one device described above. For example, device <NUM> may not have UI <NUM>.

Processor <NUM>, memory <NUM>, transmitter <NUM>, receiver <NUM> and/or UI <NUM> may be interconnected by electrical leads internal to device <NUM> in a multitude of different ways. For example, each of the aforementioned devices may be separately connected to a master bus internal to device <NUM>, to allow for the devices to exchange information. However, as the skilled person will appreciate, this is only one example and depending on the example embodiment various ways of interconnecting at least two of the aforementioned devices may be selected without departing from the scope of the present invention.

<FIG> illustrates an OAM/m-plane configuration in accordance with at least some example embodiments. As shown in <FIG>, an OAM <NUM> may transmit, at step 510a, the configuration information required to initialize the network function to operate according to a port-based network access control standard and a port-based medium access security standard on m-plane, for example in a SNMP TSN AF IOC, to a TSN AF <NUM>. Upon receiving the configuration information, the TSN AF <NUM> may configure itself to operate according to the port-based network control standard and the port-based medium access security standard based on the configuration information.

At step 520a, the TSN AF <NUM> may transmit the configuration information to at least one other NF in the cellular communication system, such as the NW-TT <NUM> and/or the DS-TT <NUM>. The configuration information may be transmitted by the TSN AF <NUM> on c-place, for example in a port management information container. Upon receiving the configuration information, the at least one other NF may configure itself to operate according to the port-based network control standard and the port-based medium access security standard based on the configuration information.

<FIG> illustrates a CNC/c-plane configuration in accordance with at least some example embodiments. As shown in <FIG>, a CNC <NUM> may transmit, at step 510b, the configuration information required to initialize the network function to operate according to a port-based network access control standard and a port-based medium access security standard on c-plane, for example in a SNMP TSN AF IOC, to a TSN AF <NUM>. The CNC may use SNMP/MIB or NETCONF/YANG. Upon receiving the configuration information, the TSN AF <NUM> may configure the at least one other NF to operate according to the port-based network control standard and the port-based medium access security standard based on the configuration information.

At step 520b, the TSN AF <NUM> may transmit the configuration information to at least one other NF in the cellular communication system, such as the NW-TT <NUM> and/or the DS-TT <NUM>. The configuration information may be transmitted by the TSN AF <NUM> on c-place, for example in a port management information container. Upon receiving the configuration information, the at least one other NF may configure itself to operate according to the port-based network control standard and the port-based medium access security standard based on the configuration information.

<FIG> is a flow graph of a first method in accordance with at least some example embodiments. The phases of the illustrated first method may be performed by an NF configured to provide time sensitive networking or communications, or by a control device configured to control the functioning thereof, possibly when installed therein.

The first method may comprise, at step <NUM>, receiving, by a network function in a cellular communication system, configuration information required to initialize at least one other network function to operate according to a port-based network access control standard and a port-based medium access security standard, wherein the network function is configured to provide time sensitive networking or communications , and the configuration information comprises a storage format of the port-based network access control standard and a storage format of the port-based medium access security standard. Also, the first method may comprise, at step <NUM>, configuring the at least one other network function to operate according to the port-based network control standard and the port-based medium access security standard based on the configuration information.

<FIG> is a flow graph of a second method in accordance with at least some example embodiments. The phases of the illustrated second method may be performed by at least one other NF configured to operate as a boundary interface to other networks and as a security endpoint, or by a control device configured to control the functioning thereof, possibly when installed therein.

The second method may comprise, at step <NUM>, receiving from a network function configured to provide time sensitive networking or communications, by another network function in a cellular communication system, configuration information required to initialize said another network function to operate according to a port-based network access control standard and a port-based medium access security standard, wherein said another network function is configured to operate as a boundary interface to other networks and as a security endpoint, and the configuration information comprises a storage format of the port-based network access control standard and a storage format of the port-based medium access security standard. Also, the second method may comprise, at step <NUM>, configuring said another network function to operate according to the port-based network control standard and the port-based medium access security standard based on the configuration information.

It is to be understood that the example embodiments disclosed are not limited to the particular structures, process steps, or materials disclosed herein, but are extended to equivalents thereof as would be recognized by those ordinarily skilled in the relevant arts. It should also be understood that terminology employed herein is used for the purpose of describing particular example embodiments only and is not intended to be limiting.

Reference throughout this specification to one example embodiment or an example embodiment means that a particular feature, structure, or characteristic described in connection with the example embodiment is included in at least one example embodiment. Thus, appearances of the phrases "in one example embodiment" or "in an example embodiment" in various places throughout this specification are not necessarily all referring to the same example embodiment.

In addition, various example embodiments and examples may be referred to herein along with alternatives for the various components thereof. It is understood that such example embodiments, examples, and alternatives are not to be construed as de facto equivalents of one another, but are to be considered as separate and autonomous representations.

In an example embodiment, an apparatus, such as, for example, the NF or the at least one other NF, or a device controlling functioning thereof, may comprise means for carrying out the example embodiments described above and any combination thereof.

In an example embodiment, a computer program may be configured to cause a method in accordance with the example embodiments described above and any combination thereof. In an exemplary example embodiment, a computer program product, embodied on a non-transitory computer readable medium, may be configured to control a processor to perform a process comprising the example embodiments described above and any combination thereof.

In an example embodiment, an apparatus, such as, for example, the NF or the at least one other NF, or a device controlling functioning thereof, may comprise at least one processor, and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured to, with the at least one processor, cause the apparatus at least to perform the example embodiments described above and any combination thereof.

Furthermore, the described features, structures, or characteristics may be combined in any suitable manner in one or more example embodiments. In the preceding description, numerous specific details are provided, such as examples of lengths, widths, shapes, etc., to provide a thorough understanding of example embodiments of the invention. One skilled in the relevant art will recognize, however, that the invention may be practiced without one or more of the specific details, or with other methods, components, materials, etc. In other instances, well-known structures, materials, or operations are not shown or described in detail to avoid obscuring aspects of the invention.

While the forgoing examples are illustrative of the principles of the example embodiments in one or more particular applications, it will be apparent to those of ordinary skill in the art that numerous modifications in form, usage and details of implementation may be made without the exercise of inventive faculty, and without departing from the principles and concepts of the invention.

At least some example embodiments find industrial application in cellular communication systems, such as <NUM> systems, and possibly in other cellular communication systems in the future wherein it is desirable to enhance security.

Claim 1:
An apparatus, comprising:
- means for receiving, by a network function (<NUM>), in a cellular communication system (<NUM>), configuration information required to initialize at least one other network function (<NUM>, <NUM>, <NUM>) to operate according to a port-based network access control standard and a port-based medium access security standard, wherein the network function (<NUM>) is configured to provide time sensitive networking or communications, and the configuration information comprises a storage format of the port-based network access control standard and a storage format of the port-based medium access security standard; and
- means for configuring the at least one other network function (<NUM>, <NUM>, <NUM>) to operate according to the port-based network access control standard and the port-based medium access security standard based on the configuration information.