Key management for machine learning models

An apparatus for wireless communication, comprising:

• at least one non-transitory memory;
• and at least one processor coupled with the at least one non-transitory memory and configured to cause the apparatus to:
• receive, from an analytics data repository function (ADRF), a first signaling indicating a request to provision a machine learning (ML) model;
• generate a first security context;
• encrypt, using the first security context, the ML model resulting in a first protected ML model;
• store the first security context and at least one of a first storage duration for the protected ML and a first validity time for the first security context;
• transmit, to the ADRF, a second signaling indicating the first protected ML model;
• and
• delete the first security context in response to the first validity time expiring or the first storage duration expiring.

A method, comprising:

• transmitting, to a network data analytics function (NWDAF) containing a model training logical function (MTLF), a first signaling indicating a request to provision a machine learning (ML) model;
• receiving, from the NWDAF containing the MTLF, a second signaling indicating a first protected ML model that has been protected using a first security context;
• storing at least one of a first validity time for the first security context and a first storage duration for the first protected ML model;
• and
• deleting the protected ML model in response to the first the first validity time expiring or the first storage duration expiring.

A method, comprising:

• receiving, from an analytics data repository function (ADRF), a first signaling indicating a request to provision a machine learning (ML) model;
• generating a first security context;
• encrypting, using the first security context, the ML model resulting in a first protected ML model;
• storing the first security context and at least one of a first storage duration for the protected ML and a first validity time for the first security context;
• transmitting, to the ADRF, a second signaling indicating the first protected ML model;
• and
• deleting the first security context in response to the first validity time expiring or the first storage duration expiring.