Department of Computer Science & Engineering

Sungkyunkwan University 2066 Seobu-Ro, Jangan-Gu Suwon Gyeonggi-Do 16419 Republic of Korea +82 31 299 4957 +82 31 290 7996 pauljeong@skku.edu http://iotlab.skku.edu/people-jaehoon-jeong.php

Department of Computer Science & Engineering

Sungkyunkwan University 2066 Seobu-Ro, Jangan-Gu Suwon Gyeonggi-Do 16419 Republic of Korea +82 31 299 4106 ahnjs124@skku.edu http://iotlab.skku.edu/people-Ahn-Yoseop.php

Department of Computer Science & Engineering

Sungkyunkwan University 2066 Seobu-Ro, Jangan-Gu Suwon Gyeonggi-Do 16419 Republic of Korea +82 31 299 4106 rna0415@skku.edu http://iotlab.skku.edu/people-Moses-Gu.php

School of Electronic Engineering

Soongsil University 369, Sangdo-ro, Dongjak-gu Seoul 06978 Republic of Korea +82 10 2691 0904 younghak@ssu.ac.kr

Standards & Open Source Research Division

Electronics and Telecommunications Research Institute 218 Gajeong-Ro, Yuseong-Gu Daejeon 34129 Republic of Korea +82 42 860 6514 pjs@etri.re.kr

Networking Network Management Research Group Internet-Draft This document describes Network Management Automation (NMA) of cellular network services in 5G networks. For NMA, it proposes a framework empowered with Intent-Based Networking (IBN). The NMA in this document deals with a closed-loop network control, network intent translator, and network management audit. To support these three features in NMA, it specifies an architectural framework with system components and interfaces. Also, this framework can support the use cases of NMA in 5G networks such as the data aggregation of Internet of Things (IoT) devices, network slicing, and the Quality of Service (QoS) in Vehicle-to-Everything (V2X).

5G networks are evolutionary mobile networks over 4G networks in terms of high speed, wide bandwidth, high frequency bands, massive device connectivity, low energy consumption, and intelligence. Especially, the intelligence will be a key feature to understand the intents of users and automate network management fully. 5G networks are designed and implemented on the experience from 4G networks and new technologies which include Software-Defined Networking (SDN) and Network Functions Virtualization (NFV) along with mmWave for low delivery delay, high data speed, and large network capacity . The support of network intelligence is one of the main goals of 5G networks. The network intelligence can provide the 5G networks with Network Management Automation (NMA) for a self-driving network that optimizes and adjusts itself by minimizing the interaction with humans (e.g., network administrators and users). Intent-Based Networking (IBN) is a feasible approach that can provide the 5G networks with the NMA services . The concept of IBN enables a closed-loop network control architecture that can adapt to the current status of a target network by collecting and analyzing monitoring data from Network Functions (NFs). NFs can be either Virtual Network Functions (VNFs), Cloud-Native Network Functions (CNFs) or Physical Network Functions (PNFs) in cloud and edge computing environments. In the 3rd Generation Partnership Project (3GPP), Network Data Analytics Function (NWDAF) is defined to collect and analyze monitoring data from multiple VNFs and PNFs in cellular networks . For the intelligent NMA services, this document proposes an architectural framework that combines the IBN and NWDAF to the 5G networks with Artificial Intelligence (AI) and Machine Learning (ML). The framework allows a network intent from either a network operator or user, which is expressed in the form in , to be translated into a network policy by a Network Intent Translator (NIT) . A Natural Language Processing (NLP) technique can be used to design and implementation of such an NIT . For the intent translation, the data model mapping between a network indent data model and a network policy needs to be performed by a data model mapper in advance . The translated network policy can be used to remotely configure NFs running on top of VNFs, CNFs or PNFs in order to enforce the commanded intent in a target network (e.g., 5G Networks). Also, it also collects and analyzes the monitoring data from VNFs, CNFs and PNFs such that the network policy can be verified and optimized to satisfy the requests for the network intent. Therefore, the NMA in this document deals with closed-loop network control, network intent translator, and network management audit. To support these three features in NMA, it specifies an architectural framework with system components and interfaces. In addition, this framework can support the use cases of NMA in 5G networks such as the data aggregation of Internet of Things (IoT) devices, network slicing, and the Quality of Service (QoS) in Vehicle-to-Everything (V2X). Especially, this document shows a use case of IoT in 5G networks such as the data collection and analysis of IoT devices.

This document uses the terminology described in , , and . In addition, the following terms are defined below: Intent: A set of operational goals (that a network should meet) and outcomes (that a network is supposed to deliver) defined in a declarative manner without specifying how to achieve or implement them . Network Management Automation (NMA): It enforces a network intent from a user (or administrator) into a target network system. The network intent can be translated into the corresponding network policy by a network intent translator (NIT) and dispatched to appropriate NFs. Through the monitoring of the NFs, the activity and performace of the NFs is monitored and analyzed. If needed, the network rules of the network policy are augmented or new network rules are generated and configured to appropriate NFs. Network Intent Translator (NIT): It translates a network intent to a network policy that can be understood and configured by an NF for a specific network service, such as the data aggregation of Internet of Things (IoT) devices, network slicing, and the Quality of Service (QoS) provisioning in Vehicle-to-Everything (V2X) communications. Feedback-Based Network Management (FNM): It means that a network service is evolved by updating a network policy (having network rules) and adding new network rules for detected network problems by processing and analzing the monitoring data of NFs.

| Vendor's Mgmt System | +-------------------+ Interface +-----------------------+ ^ ^ | | | | Analytics Interface +-----------------------+ | +------------------------>| IBN Analyzer (NWDAF) | | +-----------------------+ | NF-Facing Interface (Policy) ^ ^ ^ | | | | | | | | | +------------------------------+ | | | | +-----------------------+ | | | | Monitoring Interface | v v v v +---------------+ +---------------+ +---------------+ | NF-1 |--| NF-2 |........| NF-n | |(Net Exposure | |(Policy Control| | (IoT Device) | | Function, NEF)| | Function, PCF)| | | +---------------+ +---------------+ +---------------+ ]]>

This section describes an IBN framework for 5G networks. Note that this IBN Framework is based on the Framework for Interface to Network Security Functions (I2NSF) . As shown in , an IBN User can use network functions by delivering network intents, which specify network requirements and goals that the IBN User wants to enforce, to the IBN Controller via the Consumer-Facing Interface (CFI).

The following are the system components for the IBN framework for network management automation in 5G networks. IBN User: An entity that delivers a network intent to IBN Controller. It is assumed that a network intent is constructed by the intent data model in the 3GPP intent document . IBN Controller: An entity that controls and manages other system components in the IBN framework. It translates a network intent into the corresponding network policy and selects appropriate NFs to execute the network rules of the network policy. Vendor's Management System (VMS): An entity that provides an image of of a virtualized NF for a network service to the IBN framework, and registers the capability and access information of an NF with IBN Controller. Network Function (NF): An entity that is a Virtual Network Function (called VNF), Cloud-Native Network Function (CNF), and Physical Network Function (called PNF) which is also called Cloud-native Network Function, for a specific network service such as the data aggregation of IoT devices, network slicing, and the QoS provisioning in V2X communications. IBN Analyzer: An entity that collects monitoring data from NFs and analyzes such data for checking the activity and performance of the NFs using machine learning techniques (e.g., Deep Learning ). IBN Analyzer can be a Network Data Analytics Function (NWDAF) in 5G networks . If there is a suspicious network problem (e.g., traffic congestion and QoS degradation) for the target network or NF, IBN Analyzer delivers a report of the augmentation or generation of network rules to IBN Controller. For IBN-based network services with Feedback-Based Network Management (FNM), IBN Analyzer is a key IBN component for the IBN framework to collect monitoring data from NFs and analyzing the monitoring data. The actual implementation of the analysis of monitoring data is out of the scope of this document.

The following are the interfaces for the IBN framework. Note that the interfaces can be modeled with YANG or YAML and network policies are delivered through either RESTCONF or NETCONF . In addition, according to 3GPP specifications, REST API can be supported for those interfaces. Consumer-Facing Interface: An interface between IBN User and IBN Controller for the delivery of a network intent . NF-Facing Interface: An interface between IBN Controller and an NF (e.g., Network Exposure Function (NEF) in 5G Core Network) for the delivery of a network policy . Registration Interface: An interface between a VMS and IBN Controller for the registration of an NF's capability and access information with the IBN Controller or the query of an NF for a required low-level network policy . Monitoring Interface: An interface between an NF and IBN Analyzer for collecting monitoring data from an NF to check the activity and performance of an NF for a possible network problem . Analytics Interface: An interface between IBN Analyzer and IBN Controller for the delivery of an analytics report of the augmentation or generation of network rules to IBN Controller, which lets IBN Controller apply the report for network rules to its network policy management . For IBN-based network services with FSM, Analytics Interface is a key interface in the IBN framework to deliver an analytics report of the augmentation or generation of network rules to IBN Controller through the analysis of the monitoring data from NFs.

To facilitate Network Intent Translation, IBN Controller needs to have a Network Intent Translator (NIT) that performs the translation of a network intent (called intent) into the corresponding network policy (called policy). For the automatic NIT services, the IBN framework needs to bridge an intent data model and a policy data model in an automatic manner . Note that an intent data model is for the IBN Consumer-Facing Interface, and a policy data model is for the IBN NF-Facing Interface. shows automatic mapping of intent and policy data models for network policies. Automatic Data Model Mapper takes an intent data module for the Consumer-Facing Inteface and a policy data module for the NF-Facing Interface. It then constructs a mapping table associating the data attributes (or variables) of the intent data module with the corresponding data attributes (or variables) of the policy data module. Also, it generates a set of production rules of the grammar for the construction of an XML (or JSON) file of network policy rules. shows the procedure of network intent translation. A network policy translator is a component of IBN Controller. The translator consists of three components such as Data Model Mapper, Policy Data Extractor, Policy Data Converter, and Policy Generator.

| NF Database | | | | | +----------------------+ +--------------------+ | | | | | | | | | V | | | | +---------------+------+ | | | | | Policy Generator | | | | | +---------------+------+ | | | | | | | | | V | | | +-----------------------+--------------------------------------------+ | | | | | V | +--------------------------+-----------------------------------------------+ | NF-Facing Interface | Network Policy | V +------------------------+-------------------------+ | | | NF(s) | | | +--------------------------------------------------+ ]]>

Data Model Mapper maps the attributes and their values of a network intent to the corresponding attributes and their values of a network policy. Note that the values of a network intent may involve a human language and must be converted to an appropriate value for a network policy (e.g., employees -> 192.0.1.0/24). Data Extractor extracts the values of the attributes related to the network intent that was delivered by an IBN User to an IBN Controller through the Consumer-Facing Interface . Data Converter converts the values of the network intent's attributes into the values of the corresponding network policy's attributes to generate the network policy . Policy Generator generates the corresponding network policy that is delivered by the IBN Controller to an appropriate NF through NF-Facing Interface .

The IBN framework is weak to both an insider attack and a supply chain attack since it trusts in NFs provided by VMS and assumes that NFs work for their network services appropriately . To detect the malicious activity of either an insider attack by a malicious VMS or a supply chain attack by a compromised VMS, a network audit system is required by the IBN framework. This network audit system can facilitate the non-repudiation of configuration commands and monitoring data generated in the IBN framework. A network audit system has the following four main objectives: To check the existence of a network policy, a management system, and its procedures; To identify and understand the existing vulnerabilities and risks of either an insider attack or a supply chain attack; To review existing network controls on operational and administrative issues; To provide recommendations and corrective actions to IBN Controller for further network and security improvement.

| Audit | | | ^ | System | +--------------+--------------+ | +---------+--------+ | NF-Facing Interface | ^ | | Remote | Network Policy | Attestation | | | Interface | V | | +--------------+--------------+ | +--------+-------+ | NF(s) +------------+ | IBN Analyzer | | +------------------>| | +-----------------------------+ Monitoring +----------------+ Interface ]]>

shows activity auditing with a network audit system in the IBN framework. All the components in the IBN framwork report its activities (such as configuration commands and monitoring data) to Network Audit System as transactions through Remote Attestation Interface . The network audit system can analyze the reported activities from the IBN components to detect malicious activities such as an insider attack and a supply chain attack. Note that such a network audit system can be implemented by remote attestation or Blockchain . The details of the implementation of the network audit system are out of the scope of this document. In order to determine a minimum set of controls required to reduce the risks from either an insider attack or a supply chain attack, the network audit system should analyze the activities of all the components in the IBN framework periodically, evaluate possible risks, and take an action to such risks since vulnerabilities and threats may change in different environments over time.

This section describes a use case where a policy of IoT device data aggregation is set up in the IBN framework for 5G networks. shows the procedure of the enforcement for an IoT device data aggregation intent in the IBN Framework as follows: IBN User sends a Network Intent Request to IBN Controller. IBN Controller translates the request with its Network Intent Translator (called NIT). The NIT identifies NFs (i.e., IoT Devices) for the request after the steps of Data Extraction and Data Conversion. If the NFs are available for the requested network policy, go to the step of Policy Generation in NIT. If the NFs are unavailable for the requested network policy, go to the next step. IBN Controller sends an NF Query Request to Vendor's Management System (called VMS) to find an appropriate NF for the request network policy. If there is such an NF registered with VMS, VMS sends an NF Initializtion Request to Cloud (or Edge Server) to initialize the NF. Cloud (or Edge Server) forwards the NF Initializtion Request to the appropriate NF to let it initialize itself. The NF performs an initialization to perform a task for a network policy in 5G networks. The NF sends an NF Initialization Response to Cloud (or Edge Server) to tell Cloud (or Edge Server) its readiness to perform a task. Cloud (or Edge Server) forwards the NF Initialization Response to VMS to tell an NF's readiness to perform a task. VMS sends an NF Query Response to IBN Controller to tell an NF's readiness to perform a task along with the network access information for the NF. IBN Controller performs the step of Policy Generation in its NIT along with the network access information of an appropriate NF(s). IBN Controller sends a Network Policy Request to the appropriate NF. The NF performs the configration in the given Network Policy Request to perform the requested task (e.g., sensing and reporting). The NF sends a Network Policy Response to IBN Controller to tell its readiness to perform the requested task.

| | | | | Intent Request| | | | | | | | | | Translation: | | | | Data Extraction & | | | | Data Conversion | | | | | | | | |*** Case 1: NFs available: Go to Policy Generation *** | | | | | | |*** Case 2: NFs unavailable (START) *** | | | | | | | | |-NF Query------->| | | | | Request |-NF Initiation-->| | | | | Request | | | | | |-NF Initiation-->| | | | | Request | | | | | | | | | | NF | | | | Initialization | | | | | | | | |<-NF Initiation--| | | |<-NF Initiation--| Response | | |<-NF Query-------| Response | | | | Response | | | | | | | | |*** Case 2: NFs unavailable (END) *** | | | | | | | | Translation: | | | | Policy Generation | | | | | | | | | |--Network Policy Request---------------------------->| | | | | | | | | | NF | | | | Configuration | | | | | | |<-Network Policy Response----------------------------| | | | | | ]]>

shows the procedure of the reporting for IoT device data aggregation in the IBN Framework as follows: NF1 (as an IoT Device) sends its Sensing Data to IBN Analyzer (as an NWDAF). NF2 (as an IoT Device) sends its Sensing Data to IBN Analyzer (as an NWDAF). IBN Analyzer performs Sensing Data Aggregation and analyzes the aggregated sensing data through Machine Learning (ML) techniques. It then generates a Sensing Report for IBN Controller. IBN Analyzer sends a Sensing Report to IBN Controller. IBN Controller analyzes the Sensing Report for a further action. If a further action is needed, it updates the existing network policy or generates a new network policy. IBN Controller sends the report for the further action to IBN User optionally if the reporting is needed. For the further action, IBN Controller sends an Updated NF Policy Request or a New NF Policy Request to the appropriate NF(s). The appropriate NF(s) reconfigures the Updated NF Policy or configures the new NF Policy in its own system. The appropriate NF(s) sends an Updated NF Policy Response or a New NF Policy Response to IBN Controller.

| | | | | | | | | | NF | | | | (Re)Configuration | | | | | | |<-Updated(New) Network Policy Response---------------| | | | | | ]]>

This document does not require any IANA actions.

The same security considerations for the IBN framework are applicable to this document. The development and introduction of IBN Analyzer and Network Audit System in the IBN Framework may create new security concerns that have to be anticipated at the design and specification time. The usage of machine learning to analyze monitoring data of malicious NFs may add a risk to its model to be attacked (e.g., adversarial attack) and can result in a bad security policy that is deployed into the IBN system.

This work was supported by Institute of Information & Communications Technology Planning & Evaluation (IITP) grant funded by the Korea Ministry of Science and ICT (MSIT) (No. RS-2024-00398199 and RS-2022-II221015).

This document is made by the group effort of NMRG, greatly benefiting from inputs and texts by (Futurewei) and (Huawei). The authors sincerely appreciate their contributions. The following are coauthors of this document: Department of Computer Science & Engineering

Sungkyunkwan University 2066 Seobu-Ro, Jangan-Gu Suwon Gyeonggi-Do 16419 Republic of Korea +82 31 299 4106 sjw6136@skku.edu http://iotlab.skku.edu/people-Ji-Won-Suh.php

Department of Computer Science & Engineering

Sungkyunkwan University 2066 Seobu-Ro, Jangan-Gu Suwon Gyeonggi-Do 16419 Republic of Korea +82 31 299 4106 chrisshen@skku.edu https://chrisshen.github.io/

Department of Electrical & Computer Engineering

Sungkyunkwan University 2066 Seobu-Ro, Jangan-Gu Suwon Gyeonggi-Do 16419 Republic of Korea +82 31 299 4106 patricklink@skku.edu http://iotlab.skku.edu/people-Patrick-Lingga.php

Standards & Open Source Research Division

Electronics and Telecommunications Research Institute 218 Gajeong-Ro, Yuseong-Gu Daejeon 34129 Republic of Korea +82 42 860 5978 cyc79@etri.re.kr

The following changes are made from draft-jeong-nmrg-ibn-network-management-automation-05: This version is submitted for the maintanance of draft-jeong-nmrg-ibn-network-management-automation.