Security for 5G network slicing

One or more hardware-based non-transitory computer-readable memory devices storing computer-executable instructions which, upon execution by one or more processors disposed in a computing device deployed in a 5G (fifth generation) network having an air interface between a radio unit (RU) and a plurality of user equipment (UE) and in which the 5G network comprises a plurality of slices, cause the computing device to:

• receive encrypted information at a node of a slice among the plurality, the information comprising data for transmission on the 5G network and a policy, in which the data is encrypted using slice properties described in the policy, and in which the node supports a trusted execution environment (TEE), wherein the received encrypted information is bound to the slice using seal cryptographic primitives;
• use a decryption process at the TEE of the node of the slice to attempt to decrypt the received information, in which the decryption process is configured for success only if a configuration of the slice conforms with properties described in the policy, wherein the decryption process uses unseal cryptographic primitives;
• and
• responsively to a successful decryption process, re-encrypt the data using the slice properties described in a decrypted policy.

A computing device, comprising:

• at least one processor;
• and
• at least one hardware-based non-transitory computer-readable storage device having computer-executable instructions stored thereon which, when executed by the least one processor, cause the computing device to
• operate at least one trusted enclave on the computing device;
• instantiate a slice controller in the at least one trusted enclave, in which the slice controller is configured to control data transmissions over a trusted slice of one or more portions of a 5G (fifth generation) network, and in which the data transmissions are bound to the trusted slice by encryption of the data using slice properties provided in a policy, and in which the trusted slice comprises trusted hardware configured to verify its trustworthiness;
• dynamically collect and digest information describing properties of the trusted slice;
• maintain a trust relationship with a remote device;
• and
• report the digested information to the remote device to provide assurances that a configuration of the trusted slice conforms with the policy.