Patent ID: 12238064

DETAILED DESCRIPTION OF THE INVENTION

Embodiments of the invention provide for integrating an SDP for network applications in a 5G/6G telecommunications network. In accordance with an embodiment of the invention, UE on behalf of an end user issues a registration request tp the core network of the telecommunications network and in response, the core network routes the request to an SDP controller. The SDP controller in turn transmits an authentication request over a VPN coupling to the main controller of the core network on behalf of the UE and the end user. In response to the successful authentication of the UE and end user, the SDP controller establishes an SDP encapsulating a set of network resources of the telecommunications network within the SDP supporting microservices accessible by the UE, and a secure tunnel over which no other device is granted access between the UE and a gateway in a data plane of the telecommunications network. Thereafter, the gateway moderates subsequent data flows between the UE and the microservices. In this way, the main controller remains inaccessible to outside actors with only the SDP controller remaining exposed to the outside actors solely for the purpose of introducing the UE into the network with subsequent interactions with the UE being secured over a tunnel from the gateway to the UE. Yet, an attack upon the SDP controller in the worst case requires only the network spawning a new instance of an SDP controller thus protecting the network from cyber-attack.

In illustration of one aspect of the embodiment,FIG.1pictorially shows a process of integrating an SDP for network applications in a 5G/6G telecommunications network. As shown inFIG.1, UE110seeks registration onto an SDN architected telecommunications network by way of a base station120coupled to a centralized unit100of the network. In the course of registration, an SDP controller130in the centralized unit100receives an authentication request145from UE110. The SDP controller130in turn issues a counterpart of the authentication request145to the main controller180of the centralized unit100over a secure tunnel140established in the centralized unit100between the main controller180and the SDP controller130.

Upon an indication of affirmative authentication by the main controller180, the SDP controller130then creates an SDP160of one or more microservices170for access by the UE110. The SDP controller130further selects a particular gateway150within the centralized unit100to manage the data flow190between the UE110and the assigned SDP160. As such, the SDP controller130messages the selected gateway150the network endpoint of the assigned SDP160and that of the UE110. The selected gateway150then creates a secure tunnel115for the exclusive use of the UE110in communicating with the selected gateway150. Thereafter, the data flow190to the assigned SDP160occurs over the secure tunnel115.

Aspects of the process described in connection withFIG.1can be implemented within a data processing system. In further illustration,FIG.2schematically shows a data processing system adapted for integrating an SDP for network applications in a 5G/6G telecommunications network. The system includes a C-RAN230implemented in the control plane of an SDN. The C-RAN230includes a host computing platform240that includes one or more computers each with memory220A and one or more processors220B. Multiple different centralized units (CUs)250for respective network slices are defined in the memory220A.

Each of the CUs250includes one or more infrastructure resources260, namely virtual network functions (VNFs), accessible by different micro-services network applications285executing in an application plane of the SDN and accessible through northbound API275in order to support processing of cellular network connections with different user equipment (UE)290through distributed units (DUs)280. However, a firewall215is inter-disposed between the DUs280and the CUs250and placed in a deny-all mode. Each request received from one of the DUs280from a corresponding one of the UE290is captured by the firewall215and accessed by the main controller255in order to determine whether or not to initiate registration of the corresponding one of the UE290with an associated SDP gateway agent265adapted to manage the data flow between the corresponding one of the UE290and an assigned SDP295incorporating different ones of the micro-services network applications285.

Importantly, an SDP controller300executes as a VNF260in the memory220A. The SDP controller300includes computer program instructions enabled during execution by the processors220B to monitor the log of the firewall215and to detect in entries of the log, single packet authentication (SPA) packets received from different ones of the UE290. In response, the SDP controller300directs the main controller255to authenticate each corresponding one of the UE290. Responsive to the detection of the authentication of both a corresponding one of the UE290and an associated end user, the program instructions of the SDP controller300establish an SDP295of a set of the micro-services network applications285for use by the corresponding one of the UE290and the SDP controller300direct the SDP gateway agent265to establish a secure communications link—namely a transport layer security (TLS) conforming tunnel with the corresponding one of the UE290.

Thereafter, the corresponding one of the UE290interacts with the micro-services network applications285of the established SDP295over the tunnel (through the firewall215). In this way, a high degree of security against cyber-attack is maintained because each UE290once authenticated interacts only with the resources of the carefully defined SDP295over a tunnel established only as between the UE290and the assigned SDP gateway agent265. Prior to authentication, all traffic from the UE into the network is limited to denial by the215and the main controller255and the SDP gateway agent265remain obscured from access behind the firewall215. Thus, only the SDP controller300is exposed to the UE290and multiple SDP controllers300can be instantiated by the main controller255and, indeed, multiple different instances of the SDP controller300can be created at any one time with the main controller255selecting one of the instances from a table of available instances of the SDP controller300in order to load balance access to the different instances.

In further illustration of an exemplary operation of the module,FIG.3is a flow chart illustrating one of the aspects of the process ofFIG.1. Beginning in block305, an authentication request is received from a particular UE in a base station and in block320, the base station extracts the credentials of both the UE and an end user associated with the UE from the request. In block330, an authentication request is then formulated according to the credentials and issued over a secure tunnel to the main controller. In block340, the main controller initiates the SDP controller and in block350, the main controller forwards the authentication request to the SDP controller. Then, in decision block360, it is determined whether or not the SDP controller has authenticated the UE and end user. If not, the SDP controller is destroyed in block400. Otherwise, the process continues in block370.

In block370, an SDP controller generates the SDP for the UE including different micro-services network applications required for access by the UE and determined, for instance from the original request of the UE, or based upon a characteristic set determined for the UE. In block380, the SDP controller creates an SDP gateway agent for moderating interactivity of data flow between the UE and the SDP. Finally, in block390, the SDP controller establishes a secure tunnel between the UE and the SDP gateway agent and the SDP controller provides the SDP gateway agent with the network endpoint of the UE for the SDP gateway agent to initiate the inter-activity of the data flow to the SDP over the tunnel.

Of import, the foregoing flowchart and block diagram referred to herein illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computing devices according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which includes one or more executable instructions for implementing the specified logical function or functions. In some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts or carry out combinations of special purpose hardware and computer instructions.

More specifically, the present invention may be embodied as a programmatically executable process. As well, the present invention may be embodied within a computing device upon which programmatic instructions are stored and from which the programmatic instructions are enabled to be loaded into memory of a data processing system and executed therefrom in order to perform the foregoing programmatically executable process. Even further, the present invention may be embodied within a data processing system adapted to load the programmatic instructions from a computing device and to then execute the programmatic instructions in order to perform the foregoing programmatically executable process.

To that end, the computing device is a non-transitory computer readable storage medium or media retaining therein or storing thereon computer readable program instructions. These instructions, when executed from memory by one or more processing units of a data processing system, cause the processing units to perform different programmatic processes exemplary of different aspects of the programmatically executable process. In this regard, the processing units each include an instruction execution device such as a central processing unit or “CPU” of a computer. One or more computers may be included within the data processing system. Of note, while the CPU can be a single core CPU, it will be understood that multiple CPU cores can operate within the CPU and in either instance, the instructions are directly loaded from memory into one or more of the cores of one or more of the CPUs for execution.

Aside from the direct loading of the instructions from memory for execution by one or more cores of a CPU or multiple CPUs, the computer readable program instructions described herein alternatively can be retrieved from over a computer communications network into the memory of a computer of the data processing system for execution therein. As well, only a portion of the program instructions may be retrieved into the memory from over the computer communications network, while other portions may be loaded from persistent storage of the computer. Even further, only a portion of the program instructions may execute by one or more processing cores of one or more CPUs of one of the computers of the data processing system, while other portions may cooperatively execute within a different computer of the data processing system that is either co-located with the computer or positioned remotely from the computer over the computer communications network with results of the computing by both computers shared therebetween.

The corresponding structures, materials, acts, and equivalents of all means or step plus function elements in the claims below are intended to include any structure, material, or act for performing the function in combination with other claimed elements as specifically claimed. The description of the present invention has been presented for purposes of illustration and description but is not intended to be exhaustive or limited to the invention in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the invention. The embodiment was chosen and described in order to best explain the principles of the invention and the practical application, and to enable others of ordinary skill in the art to understand the invention for various embodiments with various modifications as are suited to the particular use contemplated.

Having thus described the invention of the present application in detail and by reference to embodiments thereof, it will be apparent that modifications and variations are possible without departing from the scope of the invention defined in the appended claims as follows: