Section: X.10 Security for AI/ML model storage and sharing
Content: The detailed procedure for secured and authorized AI/ML model sharing between different vendors is depicted in Figure X.10-1: Figure X.10-1: Secured and authorized AI/ML model sharing between different vendors 0a. NF Service producer i.e. NWDAF containing MTLF registers its NF profile in the NRF with ML Model Interoperability indicator per Analytics ID as described in clause 5.2 of TS 23.288[ Architecture enhancements for 5G System (5GS) to support network data analytics services ]  [105]. The ML Model Interoperability indicator is a list of NWDAF providers (vendors) that are allowed to retrieve ML models from this NWDAF containing MTLF. 0b. NF Service consumer e.g., NWDAF containing AnLF registers at the NRF including its Vendor ID, Editor's Note: The inclusion of Interoperability indicator of NFc and Vendor ID of NFc are needed for authorization is ffs. 0c. The model is stored in encrypted format unless both the AI/ML model producer (NWDAF MTLF) and storage platform (ADRF) are part of the same system and belong to the same vendor and operator security domain. Storage of the model in encrypted format can be required by the trust model established to store and share AI/ML models. The trust model between AI/ML NF producer (NWDAF MtLF), storage platform (ADRF) and NF consumer (e.g., AnLF) is to be determined during the implementation phase among operator and the providers of the different platforms (MTLF, AnLF, ADRF). How the model is encrypted is vendor specific. Key distribution is not specified in this document. 1. NWDAF containing MTLF triggers the Nadrf_MLModelManagement_StorageRequest as described in TS 23.288[ Architecture enhancements for 5G System (5GS) to support network data analytics services ]  [105], optionally including an allowed NFc list. The absence of allowed NFc list indicates that only the MTLF which stored the model is allowed to retrieve the model. 2. ADRF sends the response to NWDAF containing MTLF as described in TS 23.288[ Architecture enhancements for 5G System (5GS) to support network data analytics services ]  [105]. 3. NF Service consumer e.g., NWDAF containing AnLF performs Nnrf_NFDiscovery_Request operation with the requested Analytics ID to select a suitable NF Service Producer e.g., NWDAF containing MTLF. 4a. NF Service consumer e.g., NWDAF containing AnLF requests an access token from the NRF using the Nnrf_AccessToken_Get request operation. The token request message contains, besides the parameters described in clause 13.4.1.1.2, the Vendor ID of NWDAF containing AnLF and the Analytics ID. 4b. NRF checks whether the NWDAF containing AnLF is authorized to access the requested service in NWDAF containing MTLF and verifies that the NF Consumer's Vendor ID is included in the NWADF containing MTLF 's interoperability indicator for the Analytics ID and grants the token (token1), based on the vendor ID provided by the NF consumer during registration. 5. NF Service Consumer performs Nnwdaf_MLModelProvision (Analytics ID, Vendor ID and token1) service operation at the NWDAF containing MTLF to retrieve ML models for the Analytics ID. 6a. The NWDAF containing MTLF authenticates the NF Service Consumer and verifies the access token as specified in the clause 13.4.1.1.2 and ensures that the Analytics ID is included in the access token. If verification is successful, NWDAF containing MTLF determines the ML model to be shared for the requested Analytics ID and stored the NF instance ID of NWDAF containing AnLF as part of allowed NF instance list for the ML model. 6b. If the determined ML model is stored in ADRF, and if the NF Service Consumer is not yet in the allowed NFc list stored at the ADRF, the NWDAF containing MTLF triggers the update of Nadrf_MLModelManagement_StorageRequest at the ADRF, with NF ID of NWDAF containing MTLF and Model ID, adding the NF Service Consumer to the allowed NFc list. The ADRF verifies that the requesting NWDAF containing MTLF is same as the one that stored the model. Then, ADRF stores the allowed NF instance list for the ML model referenced by the Model ID. Editor's Note: New service operation Nadrf_MLModelManagement_StorageRequest Update needs to be defined by SA2. Editor's Note: How the MTLF and ADRF can identify which list of allowed NF consumers belongs to which model stored in the ADRF (e.g. by Storage Transaction ID) is ffs. 6c. ADRF sends the response to NWDAF containing MTLF which contains Model ID. Editor's Note: How the AnLF retrieve the model via MTLF should be align with SA2 and the diagram should be update accordingly. 7. NWDAF containing MTLF sends Nnwdaf_MLModelProvision Notify to the NF Service Consumer with Model ID, the address of the determined ML model, which can be either the one stored in NWDAF containing MTLF or in ADRF. If the model is stored in ADRF, this message may also contain ADRF ID. If the ML model is to be retrieved from ADRF, the following steps are applied: 8a. NF Service Consumer requests an access token from the NRF to be authorized to retrieve the model stored in ADRF as specified in clause 13.4.1. 8b. NRF verifies that the NF Service consumer e.g., NWDAF containing AnLF is authorized to access the service provided by the ADRF. If verification is successful, NRF grants the token (token2), based on the information provided in ADRF's NF profile. 9. NF Service consumer e.g., NWDAF containing AnLF requests to retrieve the target model by sending Nadrf_MLModelManagement_Retrieval Request as described in clause 10.3.4 TS 23.288[ Architecture enhancements for 5G System (5GS) to support network data analytics services ]  [105], including token2. 10. ADRF authenticates the NF Service Consumer and verifies the access token (token2) as specified in the clause 13.4.1.1.2. ADRF verifies also the NF Service Consumer’s NF ID is included in the allowed NF instance list for the ML model and/or is same as the NF ID of the MTLF that stored the model. If verification is successful, ADRF sends Nadrf_MLModelManagement_Retrieval Response to the NF Service Consumer, which contains the address of the stored model in ADRF. 11. NF Service Consumer retrieves the ML model from ADRF and decrypts the model per the vendor’s implementation.