Patent Description:
In order to meet the demand for wireless data traffic soaring since the 4th generation (<NUM>) communication system came to the market, there are ongoing efforts to develop enhanced 5th generation (<NUM>) communication systems or pre-<NUM> communication systems. For this reason, the <NUM> communication system or pre-<NUM> communication system may be referred to as the beyond <NUM> network communication system or post LTE system.

For higher data transmit rates, <NUM> communication systems are considered to be implemented on an mmWave band, such as, e.g., a band ranging from <NUM> to <NUM>. To mitigate pathloss on the mmWave frequency band and increase the reach of radio waves, the following techniques are taken into account for the <NUM> communication system: beamforming, massive multi-input multi-output (MIMO), full dimensional MIMO (FD-MIMO), array antenna, analog beamforming, and large scale antenna.

Also being developed are various technologies for the <NUM> communication system to have an enhanced network, such as evolved or advanced small cell, cloud radio access network (cloud RAN), ultra-dense network, device-to-device (D2D) communication, wireless backhaul, moving network, cooperative communication, coordinated multi-point (CoMP), and interference cancellation.

There are also other various schemes under development for the <NUM> communication system including, e.g., hybrid FSK and QAM modulation (FQAM) and sliding window superposition coding (SWSC), which are advanced coding modulation (ACM) schemes, and filter bank multi-carrier (FBMC), non-orthogonal multiple access (NOMA) and sparse code multiple access (SCMA), which are advanced access schemes.

As <NUM> communication systems and <NUM> communication systems are commercially available, virtualization-based techniques are adopted for communication network systems. For example, at least some of the functions of the wireless communication protocol which used to be processed by the base station are implemented, in the form of a software module, in a general-purpose device by network virtualization technology. <CIT> discusses distributed detection of security anomalies include a computing device to establish a trusted relationship with a security server. <CIT> provides measures for malicious network activity mitigation. <NPL>, discusses dynamic DDoS defense resource allocation using Network Function Virtualization. <NPL>, discusses an agile and effective network function virtualization infrastructure for the Internet of Things.

Although network virtualization technology has many advantages in light of flexibility and expandability, security threats and complexity of security management are increased accordingly. For example, network virtualization technology-applied equipment may experience malicious attacks which may cause security threats and, in a network virtualization technology-applied environment, if network equipment is abnormally operated due to the malicious attacks, there may be significant influence.

Embodiments of the disclosure provide a security agent installed in the equipment in which virtualization technology has been applied for a radio access network (RAN), and a security threat on the equipment or network virtualized module is determined in real-time by the security agent. Thus, the security threat may be immediately dealt with, and various attacks using weaknesses in the wireless communication protocol may be detected and handled.

According to various example embodiments, in an electronic device with a virtual network function (VNF) module which is a virtualized radio access network device, a security agent is installed separately from the virtual network function (VNF) module to enable real-time determination of security threats, thereby minimizing and/or reducing latency for security threat processing.

According to various example embodiments, a virtual network function (VNF) module which is a virtualized radio access network device and a separate security agent for determining security threats on the radio access network are installed in the same piece of equipment, minimizing and/or reducing latency while reducing overhead which may arise when processing is performed by another piece of equipment.

According to various example embodiments, in an electronic device with a virtual network function (VNF) module which is a virtualized radio access network device, a separate security agent is installed to enable real-time determination of security threats. This allows for immediate countermeasures against attacks (e.g., DoS, DDS, spoofing, or exploit) to virtualized radio access network (vRAN) equipment. Further, even when an abnormal sign is found for the data processed by the vRAN, expected attacks may be dealt with without the need for rebooting or updating the piece of equipment.

According to various example embodiments, in an electronic device with a virtual network function (VNF) module which is a virtualized radio access network device, a separate security agent is installed, and a security server gathers and analyzes the results of analysis by each security agent, thereby making it possible to deal with various types of security attacks based on network topology information.

Hereinafter, various example embodiments of the disclosure are described in greater detail with reference to the accompanying drawings. When determined to make the subject matter of the disclosure unclear, the detailed description of the known art or functions may not be provided. The terms as used herein are defined considering the functions in the disclosure and may be replaced with other terms according to the intention or practice of the user or operator. Therefore, the terms should be defined based on the overall disclosure.

The terms as used herein are provided merely to describe various example embodiments thereof, but not to limit the disclosure. The terms as used herein are provided merely to describe some embodiments thereof, but not to limit the scope of other embodiments of the disclosure. Unless otherwise defined, all terms including technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the embodiments of the disclosure pertain and should not be interpreted as overly broad or narrow. General terms as used herein should be interpreted in the context of the disclosure or as defined in dictionaries.

As used herein, the term "comprise", "include", or "have" should be appreciated not to preclude the presence or addability of features, numbers, steps, operations, components, parts, or combinations thereof as set forth herein.

It will be understood that when an element or layer is referred to as being "on", "connected to", "coupled to", or "adjacent to" another element or layer, it can be directly on, connected, coupled, or adjacent to the other element or layer, or intervening elements or layers may be present. When a component is "directly connected to" or "directly coupled to" another component, no other intervening components may intervene therebetween.

Hereinafter, various example embodiments of the disclosure will be described in greater detail with reference to the accompanying drawings. The same reference denotations may be used to refer to the same or substantially the same elements throughout the disclosure and the drawings. No duplicate description of the same elements may be provided herein. The accompanying drawings are provided for an easier understanding of the disclosure but the disclosure should not be limited thereby.

<FIG> is a diagram illustrating an example system configuration in a network environment according to an embodiment. Referring to <FIG>, according to an embodiment, a system <NUM> may include a security server <NUM> and at least one electronic device <NUM>. The security server <NUM> may include a security module (e.g., including processing circuitry and/or executable program elements) <NUM>. The security module <NUM> may be a virtualized module which is installed, in the form of software, on the security server <NUM>. According to an embodiment, the security server <NUM> may be implemented to be replaced with, or be included in, a security orchestrator (SO), element management system (EMS), or remote security agent. According to an embodiment, the security server <NUM> may be included in a server configured separately from the security orchestrator, element management system, or remote security agent. The security server <NUM> may be a server separately configured to perform security-related functions to be described below or may be a server for other purposes, or a general-purpose server, with security-related functions described below.

The electronic device <NUM> (or server) may include at least one virtualized module (e.g., including processing circuitry and/or executable program elements). According to an embodiment, the electronic device <NUM> may include at least one first virtualized module that processes wireless communication data based on a wireless network protocol. In the following description, the at least one first virtualized module may be referred to as a virtual network function (VNF) module <NUM> for ease of description. According to an embodiment, the electronic device <NUM> may include a second virtualized module that interworks with the at least one first virtualized module to process security-related functions for the at least one first virtualized module. In the following description, the second virtualized module may be referred to as a security module <NUM> or security agent (SA) for ease of description.

According to an embodiment, the VNF module <NUM> may include at least one some functions performed by at least one virtual radio access network (vRAN) device. The VNF module <NUM> may refer, for example, to a software module that may be installed on various virtual machines (VMs) to perform network traffic processing, and each VNF module <NUM> may perform configured virtualized radio access network services or part thereof. For example, each VNF module <NUM> may perform at least one radio access network function performed by a base station and may perform functions of, for example, and without limitation, at least one of a radio unit (RU), a digital unit (DU), a central/cloud unit (CU), or an access unit (AU) according to the configuration of the radio network. Various functions of the VNF module <NUM> are described in greater detail below with reference to <FIG> and <FIG>.

The VNF module <NUM> may separate a specific network function in the network device from the default hardware, thereby providing a network function and service that may be dynamically or generally executed on an electronic device (or server) with a general-purpose processor. When a plurality of VNF modules <NUM> are arranged in the electronic device <NUM>, the plurality of VNF modules <NUM> may perform the same or similar or different network functions. The VNF module <NUM> may replace at least one of various pieces of network equipment depending on the network functions it performs, and various arrangements or roles may be configured. Various embodiments of the VNF module <NUM> are described in greater detail below with reference to <FIG> and <FIG>.

According to an embodiment, each electronic device <NUM> may include a security module <NUM>. The security module <NUM> may interwork with each VNF module <NUM> configured in the electronic device <NUM> to perform at least one security-related function. For example, when an abnormal sign is identified for the wireless communication data processed based on a wireless network protocol configured as a specific VNF module <NUM> is operated, the security module <NUM> may determine presence of a radio access network security threat (e.g., denial of service (DoS), distributed DoS (DDoS), spoofing, exploit, etc.) expected in relation to the wireless communication data abnormal sign-identified by a security agent (or security module <NUM>) installed separately from the VNF module <NUM>.

Upon determining that specific wireless communication data is security threatening data, the security module <NUM> may configure or apply various security policies, such as, for example, and without limitation, instructing to discard or drop the wireless communication data, not to respond to the wireless communication data, to alert to the wireless communication data, or the like. According to an embodiment, when specific wireless communication data is determined to be security-threatening data or the security module <NUM> itself may not determine whether there is a security threat, the security module <NUM> may transmit security-related information to the security module <NUM> of the security server <NUM>. The security module <NUM> of the security server <NUM> may receive the security-related information transmitted from the security module <NUM> of the electronic device <NUM> and perform additional analysis of the wireless communication data. The security module <NUM> of the security server <NUM> may establish a new security policy or update the existing security policy according to the results of additional analysis of the wireless communication data and provide the same to each electronic device <NUM>. Various embodiments performed by the security module <NUM> of the security server <NUM> and the security module <NUM> of each electronic device <NUM> are described in greater detail below with reference to <FIG>, <FIG>, <FIG> and <FIG> (which may be referred to hereinafter as <FIG> for convenience).

<FIG> is a diagram illustrating an example configuration of a radio access network system according to an embodiment. Referring to <FIG>, according to an embodiment, a radio access network (RAN) system <NUM> may include at least one of a radio unit (RU) <NUM>, an electronic device 120a including the functions of a digital unit (DU) <NUM>, and an electronic device 120b including the functions of a central/cloud unit (CU) <NUM>. The RU <NUM> may communicate with a user terminal <NUM> via a radio space. The user terminal <NUM> may also be referred to as an electronic device, terminal, mobile equipment (ME), user equipment (UE), user terminal (UT), subscriber station (SS), wireless device, handheld device, or access terminal (AT). The user terminal <NUM> may be a device with communication functionality, such as, for example, and without limitation, a mobile phone, personal digital assistant (PDA), smartphone, wireless modem, laptop computer, or the like.

The RU <NUM> may perform processing corresponding to a lower physical layer (PHY-L) on the transmitted or received wireless communication data. The processing corresponding to the lower physical layer may include, for example, and without limitation, at least one of channel coding, antenna mapping, data modulation, or the like. The RU <NUM> may include a radio frequency (RF) module or an inter-frequency (IF) module and may convert the lower physical layer-processed data from the digital to analog signal by a digital-to-analog converter (DAC) and then convert the resultant signal into an IF signal or RF signal. The data converted into the RF signal may be transmitted via an antenna to the radio space.

The electronic device 120a including the functions of the DU <NUM> may communicate in a wired manner with the RU <NUM> via a transport network <NUM>. The link or transmission network between the RU <NUM> and the electronic device 120a including the functions of the DU <NUM> may be denoted as a fronthaul. The DU <NUM> may receive the lower physical layer-processed data from the RU <NUM> and perform higher physical layer (PHY-H) processing. The higher physical layer processing may be defined in various manners and may include, for example, and without limitation, such processing as forward error correcting (FEC) or symbol mapping. The DU <NUM> may perform media access control (MAC) layer processing and radio link control (RLC) processing on the higher physical layer-processed data.

The electronic device 120b including the functions of the CU <NUM> may communicate in a wired manner with the electronic device 120a including the functions of the DU <NUM>, via the transport network <NUM>. The link or transmission network between the electronic device 120a including the functions of the DU <NUM> and the electronic device 120b including the functions of the CU <NUM> may be denoted as a midhaul. The CU <NUM> may receive the RLC layer-processed data from the DU <NUM> and perform packet data convergence protocol (PDCP) layer processing and radio resource control (RRC) layer processing on the received data.

According to an embodiment, the processing corresponding to the wireless communication protocol layer processed by the DU <NUM> or the CU <NUM> may be configured in the form of a virtualized software module (e.g., the VNF module <NUM>) that may be dynamically and generally executed on an electronic device (or server) with a general-purpose processor.

According to an embodiment, the electronic device 120a including the functions of the DU <NUM> or the electronic device 120b including the functions of the CU <NUM> may include security modules <NUM> and <NUM>, respectively, and the security modules <NUM> and <NUM> of <FIG> may correspond to the security module <NUM> of <FIG>. The security module <NUM> included in the electronic device 120a including the functions of the DU <NUM> and the security module <NUM> of the electronic device 120b including the functions of the CU <NUM> may mutually transmit and receive security-related information or security-related messages.

The electronic device 120b including the functions of the CU <NUM> may communicate with the security server <NUM> via the transport network <NUM> which may be referred to as a backhaul. According to an embodiment, the security server <NUM> may include a security module <NUM>. The security module <NUM> included in the security server <NUM> and the security module <NUM> included in the electronic device 120a including the functions of the DU <NUM> or the security module <NUM> of the electronic device 120b including the functions of the CU <NUM> may mutually transmit and receive security-related information or security-related messages. Specific functions and operations of the security modules <NUM>, <NUM>, and <NUM> are described in greater detail below with reference to <FIG>.

<FIG> is a diagram illustrating an example configuration of wireless communication protocol of AU and CU according to an embodiment. Referring to <FIG>, according to an embodiment, the layers of wireless communication protocol may be differentiated and processed in various manners. According to an embodiment, an electronic device <NUM> including the functions of a CU <NUM> may include a security module <NUM>, and an electronic device <NUM> including the functions of an access unit (AU) <NUM> may include a security module <NUM>. The security modules <NUM> and <NUM> may correspond to the security module <NUM> of <FIG>. For example, wireless communication protocol processing by each of the RU <NUM>, DU <NUM>, and CU <NUM> as described above in connection with <FIG> may be configured in the form of the access unit (AU) <NUM> and CU <NUM> of <FIG>. According to an embodiment, as shown in <FIG>, the PDCP layer, the RLC layer, the MAC layer, and the PHY layer of the wireless communication protocol may be distributed to the CU <NUM> and the AU <NUM> as shown in <FIG>.

As an example, the AU <NUM> may perform RF processing and PHY-L layer processing, and the CU <NUM> may perform PHY-H layer processing, MAC layer processing, RLC layer processing, and PDCP layer processing. In this case, the data transmitted between the CU <NUM> and the AU <NUM> may be configured in the form of symbols or bits. As another example, the AU <NUM> may perform RF processing and PHY layer processing, and the CU <NUM> may perform MAC layer processing, RLC layer processing, and PDCP layer processing. In this case, the data transmitted between the CU <NUM> and the AU <NUM> may be configured in the form of MAC protocol data units (PDUs). As another example, the AU <NUM> may perform RF processing, PHY layer processing, and MAC layer processing, and the CU <NUM> may perform RLC layer processing and PDCP layer processing. In this case, the data transmitted between the CU <NUM> and the AU <NUM> may be configured in the form of RLC protocol data units (PDUs). As another example, the AU <NUM> may perform RF processing, PHY layer processing, MAC layer processing, and RLC layer processing, and the CU <NUM> may perform PDCP layer processing. In this case, the data transmitted between the CU <NUM> and the AU <NUM> may be configured in the form of PDCP protocol data units (PDUs).

According to an embodiment, each wireless communication protocol layer included in the CU <NUM> or AU <NUM> may be processed by a virtualized network function module (e.g., the VNF module <NUM> of <FIG>).

Processing of the layers of the wireless communication protocol is described in greater detail below with reference to <FIG>.

<FIG> is a diagram illustrating an example structure of a wireless communication protocol stack according to an embodiment. According to an embodiment, a wireless communication protocol stack <NUM> may include a packet data convergence protocol (PDCP) entity <NUM>, a radio link control (RLC) entity <NUM>, a medium access control (MAC) entity <NUM>, and a physical (PHY) entity <NUM>.

According to an embodiment, the PDCP entity <NUM> may be in charge of IP header compression/restoration. Example functions of the PDCP entity <NUM> may be summarized as follows. According to an embodiment, in an E-UTRA NR dual connectivity (EN-DC) environment, NR PDCP may be included in the LTE protocol of the UE and base station to support various EN-DC functions.

According to an embodiment, the radio link control (hereinafter, "RLC") <NUM> may reconstruct the PDCP packet data unit (PDU) into proper sizes and perform, e.g., ARQ operation. Example functions of the RLC entity <NUM> may be summarized as follows.

According to an embodiment, the MAC entity <NUM> is connected to several RLC layer devices configured in one UE and may multiplex RLC PDUs into an MAC PDU and demultiplex RCL PDUs from the MAC PDU. Example functions of the MAC entity <NUM> may be summarized as follows.

According to an embodiment, the PHY entity <NUM> channel-codes and modulates higher layer data into OFDM symbols, transmits the OFDM symbols through a wireless channel or demodulates OFDM symbols received through a wireless channel, channel-decodes and transfers the same to a higher layer.

Referring to <FIG>, according to an embodiment, the wireless communication protocol stack <NUM> may include a PDCP entity <NUM>, an RLC entity <NUM>, a MAC entity <NUM>, and a PHY entity <NUM>. The PDCP entity <NUM>, the RLC entity <NUM>, the MAC entity <NUM>, and the PHY entity <NUM> may be entities based on the radio protocol of LTE system or entities based on the radio protocol of NR system. For example, if the electronic device transmits/receives data based on LTE, the PDCP entity <NUM>, RLC entity <NUM>, MAC entity <NUM>, and PHY entity <NUM> based on the radio protocol of LTE system may be configured. For example, if the electronic device transmits/receives data based on NR, the PDCP entity <NUM>, RLC entity <NUM>, MAC entity <NUM>, and PHY entity <NUM> based on the radio protocol of NR system may be configured. For example, packet data processed based on the PDCP entity <NUM>, RLC entity <NUM>, MAC entity <NUM>, and PHY entity <NUM> may be stored at least temporarily in some logical area or some physical area of the memory <NUM> of the electronic device, as shown in <FIG>. According to an embodiment, the PDCP entity <NUM> may further include PDCP headers <NUM>, <NUM>, and <NUM> in PDCP SDUs <NUM>, <NUM>, and <NUM> which are based on data <NUM>, <NUM>, and <NUM> which are internet protocol (IP) packets and may transfer PDCP PDUs <NUM>, <NUM>, and <NUM>. The PDCP header information transferred by the LTE PDCP entity may differ from the PDCP header information transferred by the NR PDCP entity. According to an embodiment, the PDCP buffer <NUM> may be implemented in a designated logical area or physical area inside the memory <NUM>. The PDCP buffer <NUM> may receive the PDCP SDUs <NUM>, <NUM>, and <NUM> based on the PDCP entity <NUM> and, at least temporarily, store them, and the PDCP buffer <NUM> may further include the PDCP headers <NUM>, <NUM>, and <NUM> in the PDCP SDUs <NUM>, <NUM>, and <NUM> and transfer the PDCP PDUs <NUM>, <NUM>, and <NUM> to the RLC layer. According to an embodiment, the RLC entity <NUM> may add the RLC headers <NUM> and <NUM> to the first data <NUM> and second data <NUM>, respectively, which have been obtained by reconstructing the RLC SDUs <NUM>, <NUM>, and <NUM> and may transfer the RLC PDUs <NUM> and <NUM>. The LTE-based RLC header information may differ from the NR-based RLC header information.

According to an embodiment, the MAC entity <NUM> may add the MAC header <NUM> and padding <NUM> to, e.g., the MAC SDU <NUM> and transfer the MAC PDU <NUM> which, as the transport block <NUM>, may be processed in the physical layer <NUM>. The transport block <NUM> may be processed as slots <NUM>, <NUM>, <NUM>, <NUM>, and <NUM>.

According to an embodiment, although not shown in <FIG>, the memory <NUM> may include a buffer corresponding to each of the RLC layer and the MAC layer.

<FIG> is a block diagram illustrating an example configuration of an electronic device according to an embodiment of the disclosure. Referring to <FIG>, an electronic device <NUM> (e.g., the security server <NUM> or electronic device <NUM> (or server) of <FIG>) may include a processor (e.g., including processing circuitry) <NUM>, a memory <NUM>, and/or a communication interface (e.g., including communication circuitry) <NUM>.

The communication interface <NUM> may include various communication circuitry and denote hardware that may perform communication with at least one external electronic device and transmit and receive various pieces of information (or data). The communication interface <NUM> may transmit and receive data using a communication protocol, such as the transmission control protocol/Internet protocol (TCP/IP), user datagram protocol (UDP), hypertext transfer protocol (HTTP), secure hypertext transfer protocol (HTTPS), file transfer protocol (FTP), secure file transfer protocol (SFTP), and message queuing telemetry transport (MQTT), but is not limited thereto.

The communication interface <NUM> may be connected with an external electronic device via a wired or wireless communication network. In this case, the network may be a personal area network (PAN), local area network (LAN), or wide area network (WAN), depending on the area or size of the network, and may be an intranet, extranet, or Internet depending on network openness.

The wireless communication may include at least one of contact mask schemes, such as long-term evolution (LTE), LTE advance (LTE-A), 5th generation (<NUM>) mobile communication, code division multiple access (CDMA), wideband CDMA (WCDMA), universal mobile telecommunications system (UMTS), wireless broadband (WiBro), global system for mobile communications (GSM), time division multiple access (DMA), wireless-fidelity (Wi-Fi), Bluetooth, near-field communication (NFC), or Zigbee. The wired communication may include at least one of communication schemes, such as Ethernet, optical network, universal serial bus (USB), Thunderbolt, high definition multimedia interface (HDMI), recommended standard (RS)-<NUM>, power line communication, and plain old telephone service (POTS). The communication interface <NUM> may include a network interface or network chip according to the above-described wired/wireless communication scheme.

The memory <NUM> may include hardware that stores data or information in an electric or magnetic form to be accessed by the processor <NUM>. To that end, the memory <NUM> may be implemented as at least one hardware device among non-volatile memories, volatile memories, flash memories, hard disk drives (HDDs), solid state drives (SSD), random access memory (RAM) or read-only memory (ROM).

The memory <NUM> may store at least one instruction, module, or data necessary for the operation of the electronic device <NUM> or the processor <NUM>. The instruction may include a code unit instructing the electronic device <NUM> or processor <NUM> to operate and may be one created in a computer-understandable language, e.g., machine language. The module may be a set of series of instructions to perform a specific task in task units. The data may be information in bits or bytes, which may represent a letter, number, or image.

According to an embodiment, the memory <NUM> may store program information corresponding to at least one software module (e.g., the VNF module <NUM>, <NUM>, <NUM>, or <NUM>) or security agent <NUM>, or remote security agent <NUM>) described below. According to an embodiment, the memory <NUM> may store various pieces of security-related information (e.g., abnormal sign information or security policy information) to be used in the embodiments described below. The VNF module may refer, for example, to a software module that may be installed on a virtual machine (VM) (or implemented in the form of a container) to perform network traffic processing as described above, and each VNF module may perform configured virtualized radio access network services or part thereof. The remote security agent <NUM> may be installed on a virtual machine (VM) (or implemented in the form of a container) as is the above-described VNF module, processing functions related to the security of each VNF module.

The memory <NUM> may be accessed by the processor <NUM>, and reading/recording/modifying/deleting/updating of instructions, modules, or artificial intelligence models, or data may be carried out by the processor <NUM>.

The processor <NUM> may include various processing circuitry including one or more processors. The processor <NUM> may be implemented as a general-purpose processor, such as, for example, and without limitation, a central processing unit (CPU), a dedicated processor, an application processor (AP), a graphics-dedicated processor, such as a graphic processing unit (GPU) or vision processing unit (VPU), an artificial intelligence-dedicated processor, such as a neural processing unit (NPU), or the like. The processor <NUM> may control the overall configuration of the electronic device <NUM>. The processor <NUM> may be operated based on at least one operating system (OS) without limitations to a specific OS. For example, although the processor <NUM> is described below as operated on the Unix or Linux OS, embodiments of the disclosure are not limited thereto.

According to an embodiment, the processor <NUM> may load and execute the program code corresponding to each VNF module stored in the memory <NUM>. As the VNF module is executed, the processor <NUM> may perform a configured virtualized radio access network service or part thereof and may perform at least one radio access network function which is performed by the base station.

According to an example embodiment of the disclosure, an electronic device configured to perform a radio access network function comprises: a communication interface comprising communication circuitry, a processor operatively connected with the communication interface, and a memory operatively connected with the processor, wherein the memory stores instructions which, when executed, cause the processor to: receive, via the communication interface, wireless communication data transmitted via a radio access network, process the received wireless communication data based on a radio access network protocol using at least one first virtualized module corresponding to at least one function of the radio access network, identify an abnormal sign based on the received wireless communication data or a result of processing of the wireless communication data by the at least one first virtualized module, transfer security information indicating the abnormal sign to a second virtualized module by the at least one first virtualized module, and determine, by the second virtualized module, an expected security threat on the radio access network based on the security information indicating the abnormal sign.

According to an example embodiment, the at least one first virtualized module may include a virtual network function (VNF) configured to process the wireless communication data based on a wireless network protocol.

According to an example embodiment, the second virtualized module may include a security agent (SA) configured to process a function related to security for the at least one first virtualized module while interworking with the at least one first virtualized module.

According to an example embodiment, the instructions, when executed, may cause the processor to generate security information related to the wireless communication data by a security monitoring (SM) module executed in the first virtualized module.

According to an example embodiment, the first virtualized module may process the received wireless communication data based on at least one of packet data convergence protocol entity (PDCP) layer processing, radio link control entity (RLC) layer processing, medium access control (MAC) layer processing, or physical entity (PHY) layer processing.

According to an example embodiment, the expected security threat on the radio access network may include at least one of denial of service (DoS), distributed DoS (DDoS), spoofing, or exploit attack.

According to an example embodiment, the second virtualized module may be configured to determine the security threat by identifying data of a higher layer than a radio network layer processed by the at least one first virtualized module, based on the security information.

According to an example embodiment, the second virtualized module may be configured to transmit a configured countermeasure to the at least one first virtualized module upon determining the expected security threat on the radio access network.

According to an example embodiment, the configured countermeasure may include at least one of a drop, unresponsive, or alert process for the wireless communication data.

According to an example embodiment, the second virtualized module may be configured to identify wireless communication data corresponding to the generated security information to generate a security report, and to transmit the generated security report to a security server configured to manage security of equipment which perform the radio access network function.

According to an example embodiment, the second virtualized module may be configured to receive a security policy corresponding to the at least one first virtualized module from the security server and apply the received security policy to a first virtualized module corresponding to the security policy, among the at least one first virtualized module.

According to an example embodiment, the first virtualized module may be configured to determine that there is the abnormal sign based on more than a designated number of data bytes or data packets being received within a designated time, based on more than a designated number of terminals transmitting wireless communication data, or based on a specific wireless communication protocol being identified on a payload of the received wireless communication data a designated number of times or more.

According to an example embodiment, the second virtualized module may be configured to: identify payload information for the received wireless communication data and determine the security threat on the radio access network based on at least one of terminal identification information, a number of times of transmission or reception of a wireless communication protocol, or ciphered-or-not.

According to an example embodiment, a system configured to perform a radio access network function may include one or more radio access network servers configured to: process wireless communication data via a virtualized radio access network function, identify an abnormal sign, and transmit security information showing the abnormal sign and one or more security devices electrically connected with the one or more radio access network servers and determining an expected security threat on a radio access network based on the security information received from the one or more radio access network servers.

<FIG>, <FIG>, <FIG> and <FIG> are block diagrams illustrating an example configuration of a security server and an electronic device according to an embodiment. Referring to <FIG>, the security server <NUM> may include a remote security agent (RSA) <NUM> (e.g., the security module <NUM> of <FIG>). The security server <NUM> may be a server separately configured to perform security-related functions to be described below or may be a server for other purposes, or a general-purpose server, with security-related functions described below.

According to an embodiment, the RSA <NUM> may include secure storage <NUM>, a signing module (signer) <NUM>, a policy generation module (policy generator) <NUM>, a security monitoring (SM) agent <NUM>, an analysis module (packet analyzer) <NUM>, and a log collector <NUM>, each of which may include various processing circuitry and/or executable program elements.

According to an embodiment, the electronic device <NUM> may include a virtual network function (VNF) manager <NUM>, at least one first virtualized module (e.g., at least one VNF module (e.g., a first VNF module <NUM>, a second VNF module <NUM>, and a third VNF module <NUM>)), and a second virtualized module (e.g., a security agent (SA)) <NUM>.

The VNF modules <NUM>, <NUM>, and <NUM> may include security monitoring (SM) modules 541a, 542a, and 543a, respectively. According to an embodiment, the SM modules 541a, 542a, and 543a may be included, in the form of software, in the VNF modules <NUM>, <NUM>, and <NUM>, as part of the VNF modules <NUM>, <NUM>, and <NUM>. Thus, when the processor <NUM> loads the program code corresponding to each VNF module stored in the memory <NUM>, the SM module 541a, 542a, or 543a may be loaded and executed as part of the program code.

When the function related to a specific wireless communication network protocol (e.g., each wireless communication protocol performed in the DU <NUM>, AU <NUM>, or CU <NUM> or <NUM>) in the VNF module <NUM>, <NUM>, or <NUM> is performed, the SM module 541a, 542a, or 543a included in each VNF module <NUM>, <NUM>, or <NUM> may perform a designated function.

According to an embodiment, the SM modules 541a, 542a, and 543a may be implemented as processors that are executed all the time or as necessary in the VNF modules <NUM>, <NUM>, and <NUM>.

According to an embodiment, when an abnormal sign is identified in the data currently being processed in the VNF module <NUM>, <NUM>, or <NUM>, the corresponding SM module 541a, 542a, or 543a may be invoked to transfer information related to the abnormal sign to the security agent <NUM>. Further, the information transferred via the SM module 541a, 542a, or 543a to the security agent <NUM> when an abnormal sign is identified from the data being processed in the VNF module <NUM>, <NUM>, or <NUM> may be configured in various manners. For example, the transferred abnormal sign-related information may include at least one of abnormal sign information, identification information (e.g., packet identification number) regarding the data (or packet) for which the abnormal sign has been identified, or the data (or packet) for which the abnormal sign has been identified.

According to an embodiment, various methods may be implemented for the SM module 541a, 542a, or 543a to transfer the information to the security agent <NUM>. For example, in the case where an abnormal sign is identified for the data being processed in the VNF module <NUM>, <NUM>, or <NUM>, if the SM module 541a, 542a, or 543a is invoked, the identified abnormal sign information, the identification information (e.g., packet identification number) regarding the abnormal sign-identified data (or packet), or the abnormal sign-identified data (or packet) may be transferred to the security agent <NUM> as the invoked SM module 541a, 542a, or 543a is operated. As another method, in the case where the SM module 541a, 542a, or 543a is an always-on process, a specific wireless communication network protocol processed by the VNF module <NUM>, <NUM>, or <NUM> may be hooked to identify an abnormal sign and, according to the result of identification, the abnormal sign information, the identification information (e.g., packet identification information) regarding the abnormal sign-identified data (or packet), or the abnormal sign-identified data (or packet) may be transferred to the security agent <NUM>.

According to an embodiment, various methods may be configured to determine an abnormal sign for the data being processed in the VNF module <NUM>, <NUM>, or <NUM>. For example, the VNF module <NUM>, <NUM>, or <NUM> may determine that there is the abnormal sign when more than a designated number of data bytes or data packets are received within a designated time, when more than a designated number of terminals transmit wireless communication data, or when a specific wireless communication protocol is identified on a payload of the received wireless communication data, a designated number of times or more. Example embodiments of a method for determining an abnormal sign are described in greater detail below with reference to <FIG>, <FIG>, <FIG>, <FIG>, <FIG>, <FIG> (which may be referred to hereinafter as <FIG> for convenience).

According to an embodiment, the security agent <NUM> may receive information related to the data determined to have an abnormal sign from the VNF module <NUM>, <NUM>, or <NUM>. The security agent <NUM> may determine an expected security threat on the radio access network based on the information related to the abnormal sign-identified wireless communication data.

The security agent <NUM> identifies payload information for the data determined to have an abnormal sign and may determine the security threat on the radio access network based on at least one of terminal identification information, a number of times of transmission or reception of a wireless communication protocol, or ciphered-or-not. Example embodiments of a method for determining a security threat are described in greater detail below with reference to <FIG>.

According to an embodiment, various methods may be configured to determine an abnormal sign for the data being processed in the VNF module <NUM>, <NUM>, or <NUM>. According to an embodiment, the VNF module <NUM>, <NUM>, or <NUM> may determine that there is an abnormal sign when a mobile communication protocol standard is not met. For example, in the case where an essential security procedure disclosed in the mobile communication protocol standard is omitted, and the next step is performed, the VNF module <NUM>, <NUM>, or <NUM> may normally proceed with processing on the protocol corresponding to the next step. However, since the essential security procedure disclosed in the standard is omitted, it may be determined to be an abnormal sign for an attack that does not follow the mobile communication protocol standard.

According to an embodiment, even when the procedure disclosed in the mobile communication protocol standard is observed, if a specific circumstance occurs, this may be determined to be an abnormal sign. For example, in the cases where integrity may not be verified for the data observing the standard procedure, a message that should be ciphered and transmitted is transmitted as plain text, or the field value of the data header or payload is not the expected value, the VNF module <NUM>, <NUM>, or <NUM> may determine that the data has an abnormal sign even when the data observes the standard procedure.

According to an embodiment, the operation of determining an abnormal sign may include a security check pre-configured on a specific wireless communication protocol packet. Table <NUM> below illustrates an example of determining an abnormal sign via a security check processed in the VNF module <NUM>, <NUM>, or <NUM>, but embodiments of the disclosure are not limited thereto.

According to an embodiment, if there is determined to be an abnormal sign as a result of a per-item security check exemplified in Table <NUM> above, the VNF module <NUM>, <NUM>, or <NUM> may invoke the SM module 541a, 542a, or 543a and transmit the abnormal sign-related information (e.g., abnormal sign information, identification information regarding the data (or packet) for which there is determined to be an abnormal sign, and the abnormal sign-identified data (or packet)) to the security agent <NUM>. According to an embodiment, the abnormal sign-related information (e.g., the abnormal sign information), the identification information (e.g., packet identification number) regarding the abnormal sign-identified data (or packet), or the abnormal sign-identified data (or packet) transferred to the security agent <NUM> may be denoted as a security log, error log, security data, or security information in the disclosure.

Although <FIG> illustrates that the electronic device <NUM> includes three VNF modules, the electronic device <NUM> may include only one VNF module or two VNF modules, or four or more VNF modules according to various embodiments. Each VNF module <NUM>, <NUM>, or <NUM> may correspond to the VNF module <NUM> of <FIG>.

As described above, each VNF module <NUM>, <NUM>, or <NUM> may refer, for example, to a software module that may be installed on various virtual machines (VMs) or containers to perform network traffic processing, and each VNF module <NUM>, <NUM>, or <NUM> may perform configured virtualized radio access network services or part thereof. According to an embodiment, each VNF module <NUM>, <NUM>, or <NUM> may perform at least one radio access network function performed by a base station and may perform functions of, for example, and without limitation, at least one of the radio unit (RU), the digital unit (DU), the central/cloud unit (CU), or the access unit (AU) of <FIG> or <FIG> according to the configuration of the radio network.

The VNF module <NUM>, <NUM>, or <NUM> may separate a specific network function in the network device from the default hardware, thereby providing a network function and service that may be dynamically or generally executed on an electronic device (or server) with a general-purpose processor. The plurality of VNF modules <NUM>, <NUM>, and <NUM> may perform the same or similar or different network functions. For example, the plurality of VNF modules <NUM>, <NUM>, and <NUM> may replace at least one of various pieces of equipment (e.g., network-related equipment) depending on the network functions they perform, and various arrangements or roles may be configured. According to an embodiment, the first VNF module <NUM> and the second VNF module <NUM> may perform the functions of the AU <NUM>, and the third VNF module <NUM> may perform the functions of the CU <NUM>. The first VNF module <NUM> and the second VNF module <NUM> may perform the functions of the DU <NUM>, and the third VNF module <NUM> may perform the functions of the CU <NUM>. Various embodiments of the disclosure are not limited thereto but may rather be configured in various combinations.

The security agent <NUM> may include a security monitoring (SM) agent <NUM>, secure storage <NUM>, an analysis module (packet analyzer) <NUM>, and a signing module (signer) <NUM> and, according to various embodiments, may perform various security-related functions.

The kernel which plays a role as a host <NUM> for each module (e.g., the VNF manager <NUM>, VNF module <NUM>, <NUM>, or <NUM>, or security agent <NUM>) included in the electronic device <NUM> may include a shared memory <NUM>, a Linux security module (LSM) <NUM>, a daemon authentication module (daemon verifier) <NUM>, a communicator (e.g., including communication circuitry) <NUM>, and an access control module (access controller) <NUM>.

Security-related procedures performed by each of the above-described functional blocks are described below in detail with reference to <FIG>, according to an embodiment.

Referring to <FIG>, when each VNF module <NUM>, <NUM>, or <NUM> performs processing according to a specific wireless communication network protocol, the SM module 541a, 542a, or 543a included in each VNF module <NUM>, <NUM>, or <NUM> may perform a designated function. According to an embodiment, if an abnormal sign is identified for the data being processed in a specific VNF module <NUM>, <NUM>, or <NUM>, the corresponding SM module 541a, 542a, or 543a may be invoked, notifying the security agent <NUM> of the abnormal sign-related information (security information) (e.g., abnormal sign information, abnormal sign-identified data (or packet) or identification information regarding the data (or packet) for which there is determined to be an abnormal sign). As another method, the SM module 541a, 542a, or 543a may directly identify the abnormal sign by hooking the data (e.g., wireless communication network protocol-related data) being processed in the specific VNF module <NUM>, <NUM>, or <NUM>. The abnormal sign for the data being processed may be identified by performing a security check on the header or payload of the data (e.g., protocol data unit (PDU)) processed by the specific VNF module <NUM>, <NUM>, or <NUM>. For example, if an error is determined to occur in the sequence number as a result of the PDU header check on the data, the SM module 541a, 542a, or 543a of the VNF module <NUM>, <NUM>, or <NUM> may determine that the data has an abnormal sign, but embodiments of the disclosure are not limited thereto. Various embodiments related to identifying an abnormal sign via the VNF module <NUM>, <NUM>, or <NUM> or the SM module 541a, 542a, or 543a are described below in detail for each wireless communication protocol.

According to an embodiment, when the data being currently processed in the specific VNF module <NUM>, <NUM>, or <NUM> is identified to have an abnormal sign, the SM module 541a, 542a, or 543a may transfer security information to the SM agent <NUM> of the security agent <NUM>. According to an embodiment, when an abnormal sign is identified, the SM module 541a, 542a, or 543a may transfer the abnormal sign information or identification information regarding the abnormal sign-identified data (or packet) alone to the security agent <NUM> to allow the security agent <NUM> to directly identify the abnormal sign-identified data or packet using the data or packet identification information. According to an embodiment, when an abnormal sign is identified, the SM module 541a, 542a, or 543a may directly transfer the abnormal sign-identified data or packet to the SM agent <NUM>.

When the SM agent <NUM> receives the abnormal sign information, identification information regarding the abnormal sign-identified data, or the abnormal sign-identified data (or packet) from the SM module 541a, 542a, or 543a, the security agent <NUM> may additionally analyze the data (or packet) via the analysis module <NUM>. According to an embodiment, the analysis module <NUM> may analyze up to the communication protocol layer processed by the VNF module <NUM>, <NUM>, or <NUM> which has processed the abnormal sign-identified data or may analyze up to a higher communication protocol layer than the communication protocol layer processed by the VNF module <NUM>, <NUM>, or <NUM>. For example, if an abnormal sign is identified for the data (e.g., MAC PDU) while the MAC layer protocol data is being processed in the VNF module <NUM>, <NUM>, or <NUM>, the analysis module <NUM> of the security agent <NUM> may additionally analyze the MAC layer for the abnormal sign-identified data and even up to the data of the RLC layer, PDCP layer, or RRC layer which is a higher layer. According to an embodiment, when the analysis module <NUM> is to analyze data of a higher layer than the VNF module <NUM>, <NUM>, or <NUM>, it may receive an authentication key or deciphering key for analyzing the data of the higher layer from an external electronic device or other VNM module and analyze the same.

The analysis module <NUM> may determine an expected attack or security threat by the data via data analysis. For example, the expected attack determined by the analysis module <NUM> may include, for example, and without limitation, at least one of denial of service (DoS), distributed DoS (DDoS), spoofing, exploit attack, or the like. Example embodiments of determining an expected attack or security threat by the analysis module <NUM> are described in greater detail below with reference to <FIG>.

According to an embodiment, if an abnormal sign is identified for the data being processed in a specific VNF module <NUM>, <NUM>, or <NUM>, the specific VNF module <NUM>, <NUM>, or <NUM> may transmit a result of specific identification of the abnormal sign to the analysis module <NUM> of the security agent <NUM>. For example, if the data being processed in the specific VNF module <NUM>, <NUM>, or <NUM> includes an invalid sequence number, the specific VNF module <NUM>, <NUM>, or <NUM> may transmit a specific identification result, such as the sequence number or information indicating that the sequence number is invalid according to the result of identification of the abnormal sign, to the analysis module <NUM> of the security agent <NUM>. By receiving the specific identification result, the security agent <NUM> may identify specific abnormal sign-related information as well as the abnormal sign for the data. The analysis module <NUM> may quickly determine whether there is a security threat based on the specific identification result according to the identification of the abnormal sign received from the specific VNF module <NUM>, <NUM>, or <NUM>.

According to an embodiment, if it is determined by the analysis module <NUM> that there is a security threat or an expected attack, a pre-configured countermeasure or security policy may be applied based on the result of determination. For example, the SM agent <NUM> may transmit information related to the configured security policy to the VNF module <NUM>, <NUM>, or <NUM> to apply the security policy to the abnormal sign-identified data (or packet). According to an embodiment, the configured security policy may include, for example, and without limitation, at least one of a drop, unresponsive, or alert process for the wireless communication data or the packet.

According to an embodiment, upon determining that it is impossible to detect attacks only with information about the node (e.g., the electronic device <NUM>) or an attack is suspected so that an additional check is required, according to the result of analysis by the analysis module <NUM>, the SM agent <NUM> may transmit the data to the remote security agent <NUM> of the security server <NUM> to send a request for additional analysis.

As described above, as the security agent <NUM> is configured as a virtualized module separate from at least one VNF module <NUM>, <NUM>, or <NUM> in the electronic device <NUM>, security-related processing on the VNF module <NUM>, <NUM>, or <NUM> may be carried out more efficiently. For example, the at least one VNF module <NUM>, <NUM>, or <NUM> is rendered to focus only on processing as per the wireless communication protocol while security-related additional operations are allowed to be performed separately by the security agent <NUM>. This may raise both wireless communication protocol processing efficiency and security-related processing efficiency while enabling efficient operation of resource management in the electronic device <NUM>. According to an embodiment, as at least one VNF module <NUM>, <NUM>, or <NUM> is configured as a virtualized module separate from the security agent <NUM> in the electronic device <NUM>, the functions of the security agent <NUM> may be updated, with the operation of the at least one VNF module <NUM>, <NUM>, or <NUM> maintained, upon updating the functions of the security agent <NUM>. The above-described security-related procedure performed by the electronic device <NUM> is described below in greater detail in association with the kernel <NUM>.

Referring to <FIG>, the VNF manager <NUM> may manage each VNF module <NUM>, <NUM>, or <NUM> or the security agent <NUM>, and the managing functions of the VNF manager <NUM> may include such functions as installing, deleting, or updating each VNF module <NUM>, <NUM>, or <NUM> or security agent <NUM>. According to an embodiment, the VNF manager <NUM> may configure the security agent <NUM> to always operate to perform security-related functions (① of <FIG>).

According to an embodiment, the kernel <NUM> may be configured to have a daemon authentication module <NUM>, a communicator <NUM>, and an access control module <NUM> installed thereon and operated ((<NUM>) of <FIG>). When each VNF module <NUM>, <NUM>, or <NUM> is installed on the electronic device <NUM>, the corresponding SM module 541a, 542a, or 543a may be configured to be included in the VNF module <NUM>, <NUM>, or <NUM> (③ of <FIG>). At this time, binary location information and hash value for the virtualized image of each VNF module <NUM>, <NUM>, or <NUM> including the SM module 541a, 542a, or 543a may be stored in the secure storage <NUM> of the security agent <NUM> by the daemon authentication module <NUM> ((<NUM>) of <FIG>).

According to an embodiment, the access control module <NUM> may give all the VNF modules <NUM>, <NUM>, and <NUM> the right to write to the shared memory <NUM> included in the kernel <NUM> ((<NUM>) of <FIG>). The communicator <NUM> may be configured to monitor the LSM <NUM> and to identify the operation of the LSM <NUM> to obtain necessary information (⑥ of <FIG>) According to an embodiment, if an abnormal sign is identified in the specific VNF module <NUM>, <NUM>, or <NUM> so that the corresponding SM module 541a, 542a, or 543a is invoked and the abnormal sign-related information (security information) is recorded in the shared memory <NUM>, and a variation (read/write) in the shared memory <NUM> is detected by the LSM <NUM>, the communicator <NUM> may monitor the LSM <NUM> and transfer the abnormal sign-related information to the security agent <NUM>.

For example, referring to <FIG>, when each VNF module <NUM>, <NUM>, or <NUM> performs processing according to a specific wireless communication network protocol, the SM module 541a, 542a, or 543a included in each VNF module <NUM>, <NUM>, or <NUM> may perform a designated function. If the SM module 541a, 542a, or 543a installed in the VNF module <NUM>, <NUM>, or <NUM> is executed, the integrity of each SM module 541a, 542a, or 543a may be verified in various manners (e.g., Hash verification or certificate) via the daemon authentication module <NUM> (① of <FIG>). If each VNF module <NUM>, <NUM>, or <NUM> is operated, and an abnormal sign is identified in a specific VNF module, information related to the abnormal sign may be recorded in the shared memory <NUM> via the SM module 541a, 542a, or 543a ((<NUM>) of <FIG>). The access control module <NUM> may withdraw each VNF module's right to write to the shared memory <NUM> to stop the recorded abnormal sign-related information from varying (③ of <FIG>). The communicator <NUM> may monitor the LSM <NUM> and transfer the abnormal sign-related information and location information about the VNF module <NUM>, <NUM>, or <NUM> including the SM module 541a, 542a, or 543a to the SM agent <NUM> (④ of <FIG>). The SM agent <NUM> may perform authentication on the corresponding VNF module <NUM>, <NUM>, or <NUM> based on the location information about the VNF module <NUM>, <NUM>, or <NUM> including the SM module 541a, 542a, or 543a, received via the LSM <NUM> and, if authenticated as normal, store the received abnormal sign-related information in the secure storage <NUM> ((<NUM>) of <FIG>). The access control module <NUM> may reallocate the right to write to the shared memory <NUM> of each VNF module <NUM>, <NUM>, or <NUM> (⑥ of <FIG>).

According to an embodiment, the SM agent <NUM> may transmit the received abnormal sign-related information to the analysis module <NUM>. The analysis module <NUM> may determine a security threat based on the abnormal sign-related information received from the SM agent <NUM>, generate security policy information corresponding to the security threat, and transmit the security policy information to the SM agent <NUM> (⑦ of <FIG>). The SM agent <NUM> may perform processing to apply a new security policy to the corresponding VNF module <NUM>, <NUM>, or <NUM> based on the security policy information received from the analysis module <NUM> (⑧ of <FIG>). According to an embodiment, the SM agent <NUM> may transfer the new security policy to the corresponding VNF module <NUM>, <NUM>, or <NUM> via the VNF manager <NUM> to apply the new security policy to the VNF module <NUM>, <NUM>, or <NUM>. The SM agent <NUM> may transfer the new security policy via a combination of at least one or more of the shared memory <NUM>, the LSM <NUM>, the communicator <NUM>, or the access control module <NUM> in the same manner as each VNF module <NUM>, <NUM>, or <NUM> transfers the abnormal sign-related information (security information).

Referring to <FIG>, a procedure for transmitting a security report to the security server <NUM> by the security agent <NUM> of the electronic device <NUM> is described below in detail with reference to <FIG>. Referring to <FIG>, the SM agent <NUM> included in the security agent <NUM> of the electronic device <NUM> and the SM agent <NUM> included in the remote security agent <NUM> of the security server <NUM> may store mutually authenticable certificates and private keys in the secure storage <NUM> and <NUM> (① of <FIG>). The SM agent <NUM> of the security agent <NUM> may classify, per VNF module <NUM>, <NUM>, or <NUM>, the abnormal sign-related information stored in the secure storage <NUM>, generate a security report, and transfer the generated security report to the signing module <NUM> ((<NUM>) of <FIG>). The signing module <NUM> may sign the security report using the key stored in the secure storage <NUM> (③ of <FIG>). The security agent <NUM> may transfer the signed security report to the SM agent <NUM> of the remote security agent <NUM> via the SM agent <NUM> (④ of <FIG>).

A procedure of generating a security policy and transmitting the security policy to the electronic device <NUM> and applying the security policy to each VNF module <NUM>, <NUM>, or <NUM> by the remote security agent <NUM> of the security server <NUM> is described below in greater detail with reference to <FIG>.

Referring to <FIG>, the SM agent <NUM> of the remote security agent <NUM> may transfer the security report transmitted from the SM agent <NUM> of the electronic device <NUM> to the log collector <NUM> (① of <FIG>). The log collector <NUM> may transmit the security report received from the SM agent <NUM> to the signing module <NUM>. The signing module <NUM> may identify the signature value stored in the secure storage <NUM>, perform authentication processing on the security report, and then transmit the result of authentication to the log collector <NUM> ((<NUM>) of <FIG>). According to an embodiment, if the security report is authenticated as normal, the log collector <NUM> may transmit the authenticated security report to the SM agent <NUM>. The SM agent <NUM> may transfer the security report authenticated as normal to the policy generation module <NUM>, and the policy generation module <NUM> may perform analysis as to whether there is a security threat via the analysis module <NUM>. The policy generation module <NUM> may generate new security policy information to be applied to each VNF module <NUM>, <NUM>, or <NUM> according to the result of analysis by the analysis module <NUM> (③ of <FIG>). The policy generation module <NUM> may transfer the generated new security policy information to the signing module <NUM>. The signing module <NUM> may sign the new security policy information generated by the policy generation module <NUM> using the key stored in the secure storage <NUM> and may then transmit the signed security policy information to the policy generation module <NUM> ((<NUM>) of <FIG>). The policy generation module <NUM> may transmit the signed security policy information to the SM agent <NUM>. The remote security agent <NUM> may transfer the signed new security policy information to the SM agent <NUM> of the electronic device <NUM>, via the SM agent <NUM> ((<NUM>) of <FIG>). Upon receiving the new security policy information, the SM agent <NUM> of the security agent <NUM> may transmit the new security policy information to the signing module <NUM>. The signing module <NUM> may identify and thus authenticate the signature using the key stored in the secure storage <NUM> and transmit the result of authentication to the SM agent <NUM> (⑥ of <FIG>). The SM agent <NUM> may classify the new security policy authenticated as normal per VNF module <NUM>, <NUM>, or <NUM> and perform processing to apply the new security policy to the VNF module <NUM>, <NUM>, or <NUM> (⑦ of <FIG>).

Specific examples of security policies generated by the remote security agent <NUM> of the security server <NUM> and applied to each VNF module <NUM>, <NUM>, or <NUM> are described in greater detail below with reference to <FIG> and <FIG>.

According to an embodiment, the plurality of VNF modules <NUM>, <NUM>, and <NUM> shown in <FIG> may be configured to be included in different electronic devices. For example, the first VNF module <NUM> may be configured as at least one VNF module included in a first electronic device, and the second VNF module <NUM> may be configured as at least one VNF module included in a second electronic device configured separately from the first electronic device.

According to an embodiment, the security agent <NUM> shown in <FIG> may be configured to be included in an electronic device different from the plurality of VNF modules <NUM>, <NUM>, and <NUM>. For example, the plurality of VNF modules <NUM>, <NUM>, and <NUM> may be configured as at least one VNF module included in the first electronic device, and the security agent <NUM> may be configured as at least one virtualized module included in the second electronic device configured separately from the first electronic device.

When so configured, the plurality of VNF modules <NUM>, <NUM>, and <NUM> included in the first electronic device (e.g., a radio access network server) may process wireless communication data via a virtualized radio access network function. The plurality of VNF modules <NUM>, <NUM>, and <NUM> included in the first electronic device (e.g., a radio access network server) may identify an abnormal sign and transmit security information, which shows the abnormal sign, to the second electronic device (e.g., a security device or security server) configured separately from the first electronic device. The security agent included in the second electronic device may receive security information from the plurality of VNF modules <NUM>, <NUM>, and <NUM> and determine an expected security threat on the radio access network based on the received security information.

According to an embodiment, in the case where the first VNF module <NUM> includes a module performing the functions of a DU in the example described above in connection with <FIG> (e.g., when it is a virtualized module to replace the function of a piece of DU equipment), it may perform PHY-H, MAC, and RLC layer protocol data processing. For example, in <FIG>, the first VNF module <NUM> of the electronic device <NUM> may perform at least one of the MAC layer protocol data processes described above in connection with <FIG>.

<FIG>, <FIG>, <FIG> and <FIG> are diagrams illustrating an example scenario in the MAC layer according to an embodiment. The MAC layer may provide a role to manage radio resource access between UE and base station (e.g., eNB or gNB) in a specific cell. According to an embodiment, the UEs in the cell may be differentiated via cell radio network temporary identities (C-RNTI) which may be managed in the MAC layer. For example, the C-RNTI may be an identity for RRC access and be a unique UE identity used for scheduling.

Referring to <FIG>, the user equipment (UE) <NUM> in RRC-idle state may be located in Cell <NUM>610a among the cells (e.g., Cell <NUM>610a, Cell <NUM>610b, and Cell <NUM>610c) managed by a first base station (eNB) <NUM>. The UE <NUM> may perform a cell search for the first base station <NUM> and proceed with a radio access procedure (e.g., a radio resource control (RRC) connection procedure) on Cell <NUM>610a of the first base station <NUM>. The UE <NUM> which has finished the radio access procedure may switch from the RRC-Idle state to an RRC-Connected state.

<FIG> is a signal flow diagram illustrating an example radio access procedure between the UE <NUM> and the first base station (eNB) <NUM>. Referring to <FIG>, the UE <NUM> may transmit a physical random access channel (PRACH) preamble to the first base station <NUM> based on, at least, a signal (e.g., primary synchronization signal (PSS) and/or secondary synchronization signal (SSS)) received from the first base station <NUM>, in operation <NUM>. For example, the UE <NUM> may identify the PRACH parameter corresponding to the first base station <NUM> from master information block (MIB) or secondary information block (SIB) information received from the first base station <NUM> and transmit the PRACH preamble based on the identified PRACH parameter.

According to an embodiment, in operation <NUM>, the UE <NUM> may receive a PRACH response from the first base station <NUM>, in response to transmission of the PRACH preamble. The PRACH response message may include resource block assignment information and a CRNTI. In operation <NUM>, the UE <NUM> may generate an RRC connection request message including the CRNTI and transmit the RRC connection request message in response to reception of the PRACH response. According to an embodiment, in operation <NUM>, the first base station <NUM> may transmit an RRC connection response message to the UE <NUM> in response to reception of the RRC connection request message.

According to an embodiment, the C-RNTI is a value temporarily allocated by the first base station <NUM> and, if moved to another cell, a new C-RNTI is reallocated. For example, referring back to <FIG>, if the UE <NUM> assigned C-RNTI <NUM> in Cell <NUM> moves to Cell <NUM>610c, the UE <NUM> may be assigned C-RNTI <NUM>. By keeping on moving, the UE <NUM> may be located in Cell <NUM>620a among the cells (e.g., Cell <NUM>620a, Cell <NUM>620b, and Cell <NUM>620c) managed by the second base station (eNB) <NUM>. The UE <NUM> may again perform cell discovery on the second base station <NUM>, proceed with a radio access procedure on Cell <NUM>620a of the second base station <NUM>, and be assigned C-RNTI <NUM>.

According to an embodiment, the C-RNTI resource includes a value for differentiating UEs in the cell, and the UE <NUM> may attack the base stations <NUM> and <NUM> by changing the C-RNTI and sending a request for communication to the base station <NUM> or <NUM>. For example, the attack may be a DoS attack on the base station <NUM> or <NUM> and may be referred to as a "BTS resource depletion attack. " According to an embodiment, a specific device may perform an attack of depleting the RRC connection resources by allowing a specific base station to perform RRC connection while continuing to change the C-RNTI. Such attack causes no issue on the wireless communication protocol and may thus be difficult to judge as an attack.

According to an embodiment, in the case where in the example described above in connection with <FIG>, the first VNF module <NUM> includes a module performing the functions of a DU (e.g., when it is a virtualized module to replace the function of a piece of DU equipment), if the number of connected UEs in the cell, managed by itself, is a preset number or more, there may be determined to be an abnormal sign, and information related to the abnormal sign (security log) (e.g., abnormal sign-related information or information regarding the data or packet for which the abnormal sign has occurred) may be transferred to the security agent <NUM> of <FIG>, via the SM agent 541a.

According to an embodiment, if there is no response (e.g., an RRC complete message is not transmitted to the base station) after a preset number of, or more, UEs attempt RRC access within a preset time, the security agent <NUM> of <FIG> may determine that it is a DoS attack on the base station.

For example, upon performing MAC layer protocol processing on the received data according to the operation of the first VNF module <NUM> of <FIG>, the security agent <NUM> may identify the MAC layer data frame of the received data and determine whether there is an attack on the electronic device <NUM>.

According to an embodiment, as described above in connection with <FIG>, if the UE <NUM> transmits a PRACH preamble to the first base station <NUM>, the first base station <NUM> may transmit a PRACH response to the UE <NUM>. At this time, the MAC layer data frame corresponding to the PRACH response may be represented as illustrated below in <FIG>.

<FIG> is a diagram illustrating an example MAC layer data frame of the received data <NUM> identified in the security agent <NUM>. Referring to <FIG>, the MAC layer data frame of the received data <NUM> may include a MAC header <NUM> and a MAC payload <NUM>. The MAC header <NUM> may include a plurality of subheaders <NUM>. The MAC payload <NUM> may include at least one MAC control element <NUM>, at least one MAC SDU, or a padding region. The MAC header <NUM> may indicate whether C-RNTI information is included in the MAC payload <NUM> or the location of the C-RNTI information in the MAC payload <NUM>. The security agent <NUM> may identify the C-RNTI information in a specific location (e.g., the MAC control element <NUM>) inside the MAC payload <NUM> by referring to the MAC header <NUM>.

According to an embodiment, the security agent <NUM> of <FIG> may analyze the MAC layer data frame of <FIG>, thereby identifying C-RNTI data. The identified C-RNTI data may be stored in the secure storage <NUM> of <FIG>. In the case where the secure storage <NUM> is identified and, as described above, the UEs with different C-RNTIs attempt RRC access a preset number of times or more or, after attempting RRC connection, receives no response (e.g., when no RRC complete message is transmitted to the base station) within a preset time, the security agent <NUM> may determine that the UEs perform a DoS attack on the base station <NUM> or <NUM> (e.g., the electronic device <NUM>).

According to an embodiment, when specific UEs are determined to perform a DoS attack, the security agent <NUM> of <FIG> may provide identification information (e.g., C-RNTI information) about the UEs to the corresponding VNF module (e.g., the first VNF module <NUM>) and instruct the first VNF module <NUM> to apply the security policy of dropping the data received from the UE.

According to an embodiment, upon determining that a specific UE is an attacking UE via the analysis module <NUM>, the security server <NUM> may generate identification information about the UE as platooning information and transmit the same to the electronic device <NUM>. The security agent <NUM> of the electronic device <NUM> may provide the identification information about the UE determined to be an attacking UE to at least one VNF module <NUM>, <NUM>, or <NUM> and instruct the VNF module <NUM>, <NUM>, or <NUM> to apply the security policy of dropping the data received from the UE.

As described above, upon determining that a specific UE is an attacking UE by the electronic device <NUM> or the security server <NUM>, the VNF module (e.g., the first VNF module <NUM>) performing the functions of a DU in the electronic device <NUM> may preemptively block the data received from the UE.

An embodiment in which the VNF module is a module performing the functions of a CU is described in greater detail below with reference to <FIG>, <FIG>.

According to an embodiment, in the case where the third VNF module <NUM> is a module performing the functions of a CU in the example described above in connection with <FIG> (e.g., when it is a virtualized module to replace the function of a piece of CU equipment), it may perform PDCP or RRC layer protocol data processing. For example, in <FIG>, the third VNF module <NUM> of the electronic device <NUM> may perform at least one of the PDCP layer protocol data processes described above in connection with <FIG>.

<FIG>, <FIG> are diagrams illustrating an example scenario in the PDCP layer according to an embodiment. According to an embodiment, the PDCP layer protocol may perform, e.g., packet ciphering, integrity verification, and header compression. For example, the third VNF module <NUM> of <FIG> may perform the PDCP layer protocol processing of <FIG> on transmit (Tx) data or receive (Rx) data.

According to an embodiment, the PDCP layer processing unit <NUM> on the transmit side may number each packet by performing sequence numbering <NUM> on the entered transmit (Tx) data. The PDCP layer processing unit <NUM> on the transmit side may perform header compression <NUM> when the transmit data is user plane (u-plane) data. Next, the PDCP layer processing unit <NUM> on the transmit side may perform an integrity protection procedure <NUM> on control plane (c-plane) data. The PDCP layer processing unit <NUM> on the transmit side may perform ciphering <NUM> when the data is PDCP SDU-related data. When the transmit data is PDCP SDU unrelated data, the PDCP layer processing unit <NUM> on the transmit side may skip integrity protection and ciphering and add a PDCP header <NUM>. When the PDCP header-added transmit data is user plane data, the PDCP layer processing unit <NUM> on the transmit side may route <NUM> and transmit it to the wireless interface.

According to an embodiment, the receive data may be processed in a procedure reverse to that of the transmit data. For example, a PDCP layer processing unit <NUM> on the receive side may perform PDCP header removal <NUM> on the entered receive data and may then perform deciphering <NUM>, integrity verification <NUM>, and reordering <NUM>. According to an embodiment, the PDCP layer processing unit <NUM> on the receive side may omit the integrity verification procedure on user plane data and may omit the reordering procedure on control plane data.

The PDCP layer processing unit <NUM> on the receive side may release <NUM> the header compression on the reordered user plane receive data and may then perform an in-order delivery and duplicate detection procedure <NUM>. According to an embodiment, the PDCP layer processing unit <NUM> on the receive side may omit the deciphering, integrity verification, and reordering procedures on PDCP SDU unrelated packets.

When the PDCP layer protocol-processed data is control plane data, the PDCP payload may include an RRC message or non-access stratum (NAS) message. For example, referring to <FIG>, the control plane PDCP data <NUM> may include at least one R field <NUM>, a PDCP sequence number (SN) field <NUM>, a data field <NUM>, and a MAC-I field <NUM>. The R field <NUM> may refer, for example, to the reserved region, and the PDCP SN field <NUM> may refer, for example, to the PDCP sequence number. The data field <NUM> may include an RRC message or NAS message as described above. The MAC-I may include data used for the integrity verification <NUM> of <FIG>.

According to an embodiment, the security agent <NUM> of <FIG> may detect or defend attacks using the weaknesses in the RRC protocol when the third VNF module <NUM> operates as a CU. For example, a malicious UE may send an RRC connection request message, resultant from spoofing the SAE temporary mobile subscriber identity (S-TMSI) value of the target UE, to the base station to thereby disconnect the existing RRC connection. For example, the attack is a DoS attack on the UE and may be denoted "Blind DoS Attack. " According to an embodiment, since the S-TMSI value is managed by the mobility management entity (MME), it may be determined via the remote security agent <NUM> of the security server <NUM> whether there is a security threat. According to an embodiment, to continuously block the attack, the spoofed RRC connection needs to be steadily sent out. In such a case, the CU may also determine whether there is the security threat or attack. For example, when the third VNF module <NUM> of <FIG> operates as a CU, the security agent <NUM> may identify continuous reception of the RRC connection transmitted from a specific UE and determine that access by the UE is a spoofing attack. When RRC connections transmitted from UEs in the managed cell occur a predetermined number of times or more within a predetermined time, or when an RRC connection reestablishment request is received again after an RRC connection request transmitted from a specific UE, the third VNF module <NUM> may determine that this is an abnormal sign and request the security agent <NUM> to determine whether there is a security threat or attack. According to an embodiment, when RRC connection is received a preset number of times or more from the specific UE within a preset time, the security agent <NUM> may determine that the UE is a UE performing a spoofing attack. For example, the security agent <NUM> may identify the RRC message via PDCP layer protocol processing on the received data and, when the above conditions are met, provide identification information (e.g., S-TMSI information) about the UE determined to be the attacking UE to at least one VNF module <NUM>, <NUM>, or <NUM>. According to an embodiment, when RRC connection from the specific UE frequently occurs, an RRC connection reestablishment request is received again after the RRC connection request transmitted from the specific UE, the security agent <NUM> may identify the RRC message via PDCP layer protocol processing on the received data using a key (e.g., KRRCenc) for RRC communication with the specific UE. Upon identifying that the key (KRRCenc) for RRC communication is a valid key value as a result of identification of the RRC message, the security agent <NUM> may determine that the S-TMSI of the specific UE has been spoofed and provide the identification information about the UE determined to be the attacking UE to at least one VNF module <NUM>, <NUM>, or <NUM>. The security agent <NUM> may instruct the corresponding VNF module <NUM>, <NUM>, or <NUM> to apply the security policy of dropping the data received from the UE. According to an embodiment, the security agent <NUM> may perform a procedure for reissuing the S-TMSI or instruct the corresponding VNF module <NUM>, <NUM>, or <NUM> to apply the security policy of reissuing an S-TMSI.

According to an embodiment, the security agent <NUM> may determine a "key reinstallation attack" to decipher the ciphered PDCP payload and defend the same. For example, when the attacker (or attacking UE) forces the base station to fail to receive a response signal transmitted from the UE by jamming, if the base station repeatedly sends out request messages for the response signal, then the UE's PDCP SN used for generating a UE key may be repeatedly reset. The attacker may perform an attack of figuring out the key via the response signal transmitted from the UE and ciphered with the same key generated. For the type of attack, it is impossible to identify whether the failure to receive the specific message comes from jamming or a communication issue and, thus, it may be hard to determine whether there is an anomaly or abnormality. According to an embodiment, when the request messages transmitted to the UEs in the managed cell occur a predetermined number of times or more within a preset time, the third VNF module <NUM> operating as a CU may determine that this is an abnormal sign and request the security agent <NUM> to determine whether there is a security threat or attack. When a specific message is transmitted to a specific UE a preset number of times or more within a preset time, the security agent <NUM> may determine that the corresponding UE is under a key resetting attack. For example, the security agent <NUM> may identify the RRC message via PDCP layer protocol processing on the received data and, when the above conditions are met, provide identification information about the UE determined to be the attacked UE to at least one VNF module <NUM>, <NUM>, or <NUM>. According to an embodiment, the security agent <NUM> may instruct the VNF module <NUM>, <NUM>, or <NUM> to re-perform the RRC security mode procedure with the UE to vary the key (KRRCenc) value for RRC communication. According to an embodiment, when the above-described weakness in protocol or implementation is discovered, a quick response may be taken on all the CUs via the security agent <NUM>.

According to an embodiment, the security agent <NUM> of <FIG> may detect or defend attacks on the IP layer or higher layers when the third VNF module <NUM> operates as a CU. For example, when the third VNF module <NUM> of <FIG> operates as a CU, the security agent <NUM> may receive a KUPenc for deciphering the IP packet with the specific UE from the third VNF module <NUM> and decipher and identify the PDCP payload (e.g., IP packet) transmitted from the specific UE, thereby detecting or defending attacks on the IP layer or its higher layers.

<FIG> is a diagram illustrating an example structure of a PDCP PDU. A PDCP PDU may include a PDCP header <NUM> and a PDCP payload. The PDCP payload may include an IP packet <NUM> as a PDCP SDU. Referring to <FIG>, the user plane PDCP data <NUM> may include a header region <NUM> and a data region <NUM>. The header region <NUM> may include a D/C field, an R field, and a PDCP SN field. The D/C field may indicate whether the PDCP data <NUM> is user data or control data. The data region <NUM> may include an IP packet, and the IP packet may include an IP header and an IP payload. The IP header of the IP packet may include a source IP address and a destination IP address.

According to an embodiment, the security agent <NUM> may detect various attacks (e.g., DNS amplification or SYN spoofing) using IP address spoofing and may previously block it. According to an embodiment, when the PDCP data <NUM> transmitted from the UEs in the managed cell is user data, and the amount of data accumulated for a predetermined time is a predetermined amount or more or is received a predetermined number of times or more, the third VNF module <NUM> operating as a CU may determine that it is an abnormal circumstance and request the security agent <NUM> to determine whether there is an attack. For example, the security agent <NUM> may receive the KUPenc for deciphering the IP packet with the specific UE from the third VNF module <NUM> and compare the IP address of the received data with the IP address allocated to the UE. When the IP addresses are not identical as a result of comparison, the security agent <NUM> may determine that there is an attack using IP address spoofing and apply the policy of filtering the data. For example, the security agent <NUM> may provide the identification information (e.g., S-TMSI information) about the UE determined to be an attacking UE to at least one VNF module <NUM>, <NUM>, or <NUM> and instruct it to apply the policy of filtering the data. According to an embodiment, the IP address of the attacking UE may be determined via the remote security agent <NUM> of the security server <NUM>. For example, the security agent <NUM> may identify the IP packet determined to be malicious from the security server <NUM>, receive the source IP address of the IP packet, and provide the received IP address to at least one VNF module <NUM>, <NUM>, or <NUM>. The security agent <NUM> may instruct the corresponding VNF module <NUM>, <NUM>, or <NUM> to apply the security policy of dropping the data received from the corresponding IP address.

According to an embodiment, the above-described roles of the intrusion detection system (IDS)/intrusion prevention system (IPS) for the IP layer may be performed by a regular network via a CU, but the security agent <NUM> may use additional information for the UE using RRC connection and the electronic device <NUM> may block it in advance, thereby reducing network traffic.

According to an embodiment, the security agent <NUM> may set the UE transmitting wireless communication network protocol data, which does not observe the RRC protocol, as a UE required to be monitored, determine whether there is an attack by monitoring all the time, and defend attacks. For example, when the third VNF module <NUM> of <FIG> operates as a CU, if a specific UE transmits an RRC message in the state of sending no message containing an RRC security mode-related protocol, the third VNF module <NUM> may determine that this is an abnormal sign. In this case, the wireless communication network protocol sent from the UE has not been ciphered or integrity-checked and is thus vulnerable to security. Thus, the third VNF module <NUM> may transfer information regarding the abnormal sign or information about the specific UE to the security agent <NUM>, requesting the security agent <NUM> to perform monitoring. According to an embodiment, the security agent <NUM> may register the specific UE as a UE required to be monitored all the time, identify the RRC message via PDCP layer protocol processing on the data received from the specific UE, and then determine that the registered UE is a UE attacking in a smaller number of times than a preset number. According to an embodiment, the security agent <NUM> may identify that the PDCP message has not been ciphered and may additionally analyze the non-ciphered PDCP payload. For example, the security agent <NUM> may analyze the header information on the IP packet <NUM> with a pre-configured security rule or PDCP SDU to thereby check if it is malicious IP and then determine whether there is an attack. According to an embodiment, when the above-described condition is met, the security agent <NUM> may provide identification information about the UE determined to be the attacking UE to at least one VNF module <NUM>, <NUM>, or <NUM>. The security agent <NUM> may instruct the corresponding VNF module <NUM>, <NUM>, or <NUM> to apply the security policy of dropping the data received from the UE.

<FIG> and <FIG> are diagrams illustrating an example of applying a security policy while interworking with a security server according to an embodiment. Referring to <FIG>, the respective security modules 122a, 122b, 122c, and 122d of electronic devices 120a, 120b, 120c, and 120d may determine a security threat based on security information generated as VNF modules 121a, 121b, 121c, and 121d operate and, according to a result of determination, generate a security report and transmit the security report to the security module <NUM> of the security server <NUM>.

For example, the security module 122a of the first electronic device 120a may analyze the data based on security information generated as the VNF module 121a operates and transmit a security report including the source IP address and destination IP address (Source: <NUM>. <NUM> to <NUM>, Destination: <NUM>. <NUM>) of the data (or IP packet) for which a security threat is expected as a result of analysis to the security module <NUM> of the security server <NUM>.

Likewise, the security module 122b of the second electronic device 120b may analyze the data based on security information generated as the VNF module 121b operates and transmit a security report including the source IP address and destination IP address (Source: <NUM>. <NUM> to <NUM>, Destination: <NUM>. <NUM>) of the data (or IP packet) for which a security threat is expected as a result of analysis to the security module <NUM> of the security server <NUM>.

Likewise, the security module 122c of the third electronic device 120c may transmit a security report including the source IP address and destination IP address (Source: <NUM>. <NUM> to <NUM>, Destination: <NUM>. <NUM>) of the data (or IP packet) for which a security threat is expected to the security module <NUM> of the security server <NUM>, and the security module 122d of the fourth electronic device 120d may transmit a security report including the source IP address and destination IP address (Source: <NUM>. <NUM> to <NUM>, Destination: <NUM>. <NUM>) of the data (or IP packet) for which a security threat is expected to the security module <NUM> of the security server <NUM>.

Upon receiving the security reports from the electronic devices 120a, 120b, 120c, and 120d, the security server <NUM> may analyze the information included in the security reports, generating a new security policy. For example, when the packet transmitted from the device corresponding to the addresses from <NUM>. * to <NUM>. * is directed to the destination <NUM>. <NUM> as a result of analysis of the information included in the security reports received from the electronic devices 120a, 120b, 120c, and 120d, the security module <NUM> of the security server <NUM> may determine that the packet is a packet threatening security (e.g., DDoS attack) and generate security policy information to block the packet. The security server <NUM> may transmit the generated security policy information to the security module 122a, 122b, 122c, or 122d of each electronic device 120a, 120b, 120c, or 120d. The security module 122a, 122b, 122c, or 122d of each electronic device 120a, 120b, 120c, or 120d may instruct each VNF module 121a, 121b, 121c, or 121d to apply the security policy information received from the security server <NUM>.

When the packets transmitted from the devices corresponding to the addresses from <NUM>. * to <NUM>. * are directed to the destination <NUM>. <NUM> according to the security policy newly applied to each VNF module 121a, 121b, 121c, or 121d, the packets may be handled to be dropped.

Referring to <FIG>, the security module <NUM> of the electronic device <NUM> may determine a security threat based on security information generated as VNF module <NUM> operates and, according to a result of determination, transmit a security report to the security module <NUM> of the security server <NUM>. For example, the security module <NUM> of the electronic device <NUM> may check the NAS message of the received message and, upon determining that there is a likelihood of security threat, transmit the NAS message to the security server <NUM>. Upon determining that there is a security threat as a result of analysis of the NAS message transmitted from the security module <NUM> of the electronic device <NUM>, the security module <NUM> of the security server <NUM> may generate new security policy information related thereto. For example, the security module <NUM> of the security server <NUM> may analyze the message authentication code (MAC) information included in the NAS message, sequence number, and NAS message and, when the MAC information has an error, the sequence number is duplicate, or the NAS message is plain text which has not been ciphered, the security module <NUM> of the security server <NUM> may determine that the NAS message has a security threat.

The security module <NUM> of the security server <NUM> may generate security policy information to block the base station <NUM> which has transmitted the NAS message and provide the security policy information to the security module <NUM> of the electronic device <NUM>.

The security module <NUM> of each electronic device <NUM> may instruct each VNF module <NUM> to apply the security policy information received from the security server <NUM>. According to the security policy newly applied to each VNF module <NUM>, the base station <NUM> may be blocked off, or the data transmitted from the base station <NUM> all may be dropped.

<FIG> is a flowchart illustrating an example operation procedure by an electronic device according to an embodiment. Referring to <FIG>, according to an embodiment, the electronic device <NUM> may receive wireless communication data transmitted via a radio access network in operation <NUM>.

In operation <NUM>, the electronic device <NUM> may process the received wireless communication data, based on a radio access network protocol, by at least one first virtualized module (e.g., the VNF module <NUM>).

In operation <NUM>, the electronic device <NUM> may identify an abnormal sign based on the received wireless communication data or a result of processing of the wireless communication data, by the at least one first virtualized module.

Upon determining that there is an abnormal sign for the data as a result of the identification, the electronic device <NUM> may transfer the security information showing the abnormal sign to a second virtualized module (e.g., the security agent <NUM>) in operation <NUM> and, in operation <NUM>, the electronic device <NUM> may determine a security threat on the radio access network based on the security information showing the abnormal sign, by the second virtualized module (e.g., the security agent <NUM>).

<FIG> is a signal flow diagram illustrating an example operation procedure between devices according to an embodiment. Referring to <FIG>, according to an embodiment, a VNF module <NUM> of an electronic device <NUM> may process data according to a wireless communication protocol in operation <NUM>.

In operation <NUM>, the VNF module <NUM> may identify an abnormal sign based on the received wireless communication data or a result of processing of the wireless communication data.

In operation <NUM>, the VNF module <NUM> may transfer abnormal sign-related information (e.g., abnormal sign information, identification information (e.g., packet identification information) regarding the abnormal sign-identified data (or packet), or the abnormal sign-identified data (or packet)) for the identified abnormal sign to the security agent <NUM> in the electronic device <NUM>.

In operation <NUM>, the security agent <NUM> may additionally analyze the abnormal sign-identified data and, in operation <NUM>, generate a new security policy or identify a preconfigured security policy according to the result of analysis.

In operation <NUM>, the security agent <NUM> may instruct the VNF module <NUM> to apply the new security policy or identified security policy.

In operation <NUM>, the VNF module <NUM> may receive an instruction to apply the security policy of the security agent <NUM> and apply the security policy.

According to an embodiment, in operation <NUM>, the security agent <NUM> may transmit the result of analysis to the remote security agent <NUM> of the security server <NUM>.

In operation <NUM>, the remote security agent <NUM> may perform additional analysis based on the result of analysis received from the security agent <NUM> of the electronic device <NUM>.

In operation <NUM>, the remote security agent <NUM> may generate new security policy information as a result of the additional analysis.

In operation <NUM>, the remote security agent <NUM> may transmit the generated new security policy information to the security agent <NUM> of the electronic device <NUM>.

In operation <NUM>, the security agent <NUM> of the electronic device <NUM> may store the new security policy information received from the remote security agent <NUM> of the security server <NUM>.

In operation <NUM>, the security agent <NUM> may instruct the VNF module <NUM> to apply the received new security policy.

In operation <NUM>, the VNF module <NUM> may receive the instruction to apply the new security policy of the security agent <NUM> and apply the security policy.

According to an example embodiment, a method for determining a security threat on a radio access network by an electronic device comprises: receiving wireless communication data transmitted via a radio access network, processing the received wireless communication data based on a radio access network protocol by at least one first virtualized module corresponding to at least one function of the radio access network, identifying an abnormal sign based on the wireless communication data or a result of processing of the wireless communication data by the at least one first virtualized module, transferring information related to the wireless communication data to a second virtualized module by the at least one first virtualized module, and determining an expected security threat on the radio access network based on the abnormal sign-identified wireless communication data-related information by the second virtualized module.

According to an example embodiment, generating the security information may include generating the wireless communication data-related security information by a security monitoring (SM) daemon executed in the VNF module.

According to an example embodiment, the VNF module may process the received wireless communication data based, for example, and without limitation, on at least one of packet data convergence protocol entity (PDCP) layer processing, radio link control entity (RLC) layer processing, medium access control (MAC) layer processing, or physical entity (PHY) layer processing.

According to an example embodiment, the expected security threat on the radio access network may include, for example, and without limitation, at least one of denial of service (DoS), distributed DoS (DDoS), spoofing, or exploit attack.

According to an example embodiment, the security agent may determine the security threat by identifying data of a higher layer than a radio network layer processed by the first virtualized module based on the generated security information.

According to an example embodiment, the security agent may transmit a configured countermeasure to the at least one first virtualized module upon determining the expected security threat on the radio access network. The configured countermeasure may include, for example, and without limitation, at least one of a drop, unresponsive, or alert process for the wireless communication data.

According to an example embodiment, the first virtualized module may determine that there is the abnormal sign based on more than a designated number of data bytes or data packets being received within a designated time, based on more than a designated number of terminals transmitting wireless communication data, or based on a specific wireless communication protocol being identified on a payload of the received wireless communication data, a designated number of times or more.

According to an example embodiment, the second virtualized module may identify payload information for the received wireless communication data and determine the security threat on the radio access network based, for example, and without limitation, on at least one of terminal identification information, a number of times of transmission or reception of a wireless communication protocol, or ciphered-or-not.

The electronic device according to various example embodiments may be one of various types of electronic devices. The electronic devices may include, for example, and without limitation, a portable communication device (e.g., a smart phone), a computer device, a portable multimedia device, a portable medical device, a camera, a wearable device, a home appliance, or the like.

As used herein, each of such phrases as "A or B", "at least one of A and B", "at least one of A or B", "A, B, or C", "at least one of A, B, and C," and "at least one of A, B, or C" may include all possible combinations of the items enumerated together in a corresponding one of the phrases. It is to be understood that if an element (e.g., a first element) is referred to, with or without the term "operatively" or "communicatively", as "coupled with", "coupled to," "connected with," or "connected to" another element (e.g., a second element), the element may be coupled with the other element directly (e.g., wiredly), wirelessly, or via a third element.

Various embodiments as set forth herein may be implemented as software (e.g., the program) including one or more instructions that are stored in a storage medium (e.g., internal memory or external memory) that is readable by a machine (e.g., a master device or a device performing tasks). For example, a processor of the machine (e.g., a master device or a device performing tasks) may invoke at least one of the one or more instructions stored in the storage medium, and execute it, with or without using one or more other components under the control of the processor. The one or more instructions may include a code made by a complier or a code executable by an interpreter. Wherein, the "non-transitory" storage medium is a tangible device, and may not include a signal (e.g., an electromagnetic wave), but this term does not differentiate between where data is semi-permanently stored in the storage medium and where the data is temporarily stored in the storage medium.

Claim 1:
An electronic device (<NUM>) configured to perform a radio access network function, the electronic device (<NUM>) comprising:
a communication interface comprising communication circuitry;
a processor operatively connected with the communication interface; and
a memory operatively connected with the processor, wherein
the memory stores instructions which, when executed, cause the processor to:
receive, via the communication interface, wireless communication data transmitted via a radio access network,
process the received wireless communication data based on a radio access network protocol by at least one first virtualized module (<NUM>, <NUM>, <NUM>) of the electronic device (<NUM>) corresponding to at least one function of the radio access network,
identify a wireless communication data abnormal sign based on the received wireless communication data or a result of processing of the wireless communication data by the at least one first virtualized module (<NUM>, <NUM>, <NUM>),
transfer security information indicating the wireless communication data abnormal sign to a second virtualized module (<NUM>) of the electronic device (<NUM>) by the at least one first virtualized module (<NUM>, <NUM>, <NUM>), and
determine a security threat on the radio access network based on the security information indicating the wireless communication data abnormal sign by identifying payload information for the wireless communication data determined to have the wireless communication data abnormal sign by the second virtualized module (<NUM>).