# US 2025/0097712 A1 · Trust architecture for telecommunication network slice security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0097712 A1 - Document ID: US20250097712A1 - Status: Published application - Kind: A1 - Application number: 18/468,360 - Filed: 2023-09-15 - Published: 2025-03-20 - Earliest claimed: 2023-09-15 - Assignees: T-Mobile Innovations LLC - Applicants: T-Mobile Innovations LLC - Inventors: Marouane BALMAKHTAR; Lyle Walter Paczkowski; Gallip Murat Karabulut - Web page: https://patentgrep.com/patent/US20250097712A1 ## CPC - H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications - H04W 12/08: Access security - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract In various embodiments, systems and methods for a trust architecture for telecommunication network slice security are disclosed. In some embodiments a trust architecture for telecommunication network slice security distributes network security functionality to individual network entities that constitute elements of a network slice instance. Slice network functions each individually implement components of the trust architecture for the network slice using a policy enforcement point (PEP) and a policy decision point (PDP). Each slice network function thus validates the authenticity and authorized privileges associated with the subject entity seeking a service from that slice network function, and grants or denies such service requests based on a policy implemented by the PEP and PDP. ## Claims ### Claim 1 A system for telecommunication network slice security, the system comprising: one or more processors; and one or more computer-readable media storing computer-usable instructions that, when executed by the one or more processors, cause the one or more processors to: establish a network slice instance on a telecommunications network, the network slice instance comprising at least a plurality of slice network functions corresponding to network functions of an operator core network of the telecommunications network; establish a trust architecture for the network slice instance based on a slice security policy defined by a slice trust manager, wherein the slice trust manager defines a plurality of slice protection points, each slice protection point corresponding to a slice network function of the plurality of slice network functions within the network slice instance; execute a local policy decision point and a local policy execution point at each slice network function corresponding to a respective slice protection point of the plurality of slice protection points; and for at least a first slice network function of the plurality of slice network functions, apply the local policy execution point to regulate service requests based on a local security policy defined by the local policy decision point based on the slice security policy. ### Claim 2 (depends on 1) The system of claim 1, wherein the plurality of slice network functions further correspond to one or more functions of at least one of: a radio access network coupled to the operator core network, a server coupled to a core network edge of the operator core network, a customer premise gateway coupled to the operator core network via an access network, and at least one user equipment (UE) having access to the network slice instance. ### Claim 3 (depends on 1) The system of claim 1, wherein the plurality of slice protection points further includes at least one of: a resource node accessible via the plurality of slice network functions, and a subject node that transmits the service requests. ### Claim 4 (depends on 1) The system of claim 1, wherein the service requests include at least one service request received at the first slice network function for access to a resource accessible through the first slice network function. ### Claim 5 (depends on 1) The system of claim 1, wherein the service requests include at least one service request generated by the first slice network function for access to a resource accessible through a second slice network function of the network slice instance. ### Claim 6 (depends on 1) The system of claim 1, the one or more processors further to: configure the slice security policy at least in part based on configuration information received from a security manager of an enterprise infrastructure network coupled to the network slice instance via an access network. ### Claim 7 (depends on 1) The system of claim 1, the one or more processors further to: determine the local security policy from at least a portion of the slice security policy; and communicate the local security policy from the slice trust manager to the local policy decision point. ### Claim 8 (depends on 1) The system of claim 1, wherein the slice trust manager comprises a roster of slice network functions corresponding to the plurality of slice protection points; and wherein the roster of slice network functions identifies at least one of authorized interconnects, valid requests, or blocked interconnects, for each respective slice network function corresponding to a respective protection point of the plurality of slice protection points. ### Claim 9 (depends on 1) The system of claim 1, the one or more processors further to: access one or more records from a ledger to determine at least part of the slice security policy, wherein the ledger comprises at least one of a blockchain ledger technology or a hyperledger technology. ### Claim 10 A method for telecommunication network slice security, the method comprising: receiving a service request at a first slice network function for a network slice instance, the network slice instance comprising at least a plurality of slice network functions corresponding to network functions of an operator core network of a telecommunications network; applying a policy enforcement point corresponding to the first slice network function to regulate granting of the service request based on a local security policy for the first slice network function defined by a policy decision point corresponding to the first slice network function; and generating a response to the service request based at least in part on applying the policy enforcement point. ### Claim 11 (depends on 10) The method of claim 10, the method further comprising: establishing a trust architecture for the network slice instance based on a slice security policy defined by a slice trust manager, wherein the slice trust manager defines a plurality of slice protection points, each slice protection point corresponding to a slice network function of the plurality of slice network functions within the network slice instance; and regulating service requests using the policy execution point based on the local security policy defined by the policy decision point at least in part based on the slice security policy. ### Claim 12 (depends on 11) The method of claim 11, the method further comprising: updating the local security policy at least in part based on an update to the slice security policy. ### Claim 13 (depends on 10) The method of claim 10, wherein the first slice network function corresponds to a network function of the operator core network of the telecommunications network. ### Claim 14 (depends on 10) The method of claim 10, wherein the first slice network function corresponds to at least one of: a function of a radio access network coupled to the operator core network, a function of a server coupled to a core network edge of the operator core network, a function of a customer premise gateway coupled to the operator core network via an access network, and a function of at least one user equipment (UE) having access to the network slice instance. ### Claim 15 (depends on 10) The method of claim 10, wherein the service request comprises a request received at the first slice network function for access to a resource accessible through the first slice network function. ### Claim 16 (depends on 10) The method of claim 10, wherein the service request comprises at least one service request generated by the first slice network function for access to a resource accessible through a second slice network function of the network slice instance. ### Claim 17 (depends on 10) The method of claim 10, the method further comprising: configuring the local security policy at least in part based on configuration information received from a security manager of an enterprise infrastructure network coupled to the network slice instance via an access network. ### Claim 18 A system for telecommunication network slice security, the system comprising: one or more processors; and one or more computer-readable media storing computer-usable instructions that, when executed by the one or more processors, cause the one or more processors to: orchestrate a network slice instance for an operator core network of a telecommunications network, the network slice instance comprising at least a plurality of slice network functions corresponding to network functions of the operator core network; determine a slice security policy comprising a plurality of slice protection points, each slice protection point corresponding to a slice network function of the plurality of slice network functions within the network slice instance; and for each slice network function corresponding to a slice protection point, execute a local policy execution point and a local policy decision point, wherein the local policy execution point regulates service requests based on a local security policy defined by the local policy decision point based on the slice security policy. ### Claim 19 (depends on 18) The system of claim 18, the one or more processors further to: establish a data link between the operator core network and an infrastructure network via the network slice instance, wherein the operator core network and the infrastructure network are coupled by a gateway; and determine the slice security policy based at least in part on configuration information received from the infrastructure network. ### Claim 20 (depends on 18) The system of claim 18, the one or more processors further to: access one or more records from a ledger to determine at least part of the slice security policy, wherein the ledger comprises at least one of a blockchain ledger technology or a hyperledger technology.