A decentralized network service management method, system and device

Abstract

The application provides a kind of decentralized network service management method, system and equipment.The method comprises: based on network domain security mechanism and the security channel between NF node is established;In response to the registration request sent from the security channel by NF node, the registration information carried in the registration request is verified;If verification succeeds, the attribute private key corresponding to the configuration of NF node is generated according to the current version number;And attribute public key, attribute private key, hash function, symmetric key and symmetric encryption / decryption function are sent to NF node through security channel;So that NF node is established by attribute public key, attribute private key, hash function, symmetric key communication.Effectively solve the attribute update problem, realize efficient, flexible attribute addition, change and revocation, and the management of safe attribute key in this way, network function can realize self-update access control policy, realize the security protection under the offline state of NRF.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a decentralized network service management method, system, and device. Background Technology

[0002] In the core network SBA (Service-based Architecture) architecture, the NRF (Network Repository Function) is responsible for service discovery and authorization between NFs (Network Functions), maintaining the configuration information of NF instances and the services they support. The NRF implements access control between NFs through authentication and authorization. This centralized authorization access architecture faces the following problems:

[0003] 1. The NRF is responsible for service discovery, service authorization and service access among all NFs in the core network. The centralized NF management places high demands on the performance of the NRF, and the performance of the NRF is also a bottleneck for the efficiency of core network function management.

[0004] 2. NRF is vulnerable to single points of failure. If NRF is attacked, such as by DoS or DDoS attacks, the network function management of the entire core network will be paralyzed.

[0005] 3. NRF needs to be online in real time to maintain control over service access. Summary of the Invention

[0006] In view of this, the present invention provides a decentralized network service management method, system and device.

[0007] According to a first aspect of the present invention, a decentralized network service management method is provided, the method being applied to a management server, the management server including an NRF node, the method comprising:

[0008] Establish a secure channel between the network domain security mechanism and the NF node;

[0009] Respond to the registration request sent by the NF node from the secure channel and verify the registration information carried in the registration request;

[0010] If the verification is successful, an attribute private key corresponding to the configuration of the NF node is generated according to the current version number; and the attribute public key, attribute private key, hash function, symmetric key and symmetric encryption / decryption function are sent to the NF node through a secure channel so that the NF nodes can establish communication with each other through the attribute public key, attribute private key, hash function and symmetric key.

[0011] Among some possible implementations of the first aspect, before / simultaneously establishing a secure channel between the network domain security mechanism and the NF node, the method further includes:

[0012] Generate the current version number, configure the digital certificate, and upload the certificate public key to the CSP so that the CSP can verify it when storing key-value pairs on the NRF node;

[0013] Generate symmetric keys for encrypting / decrypting NF nodes based on encryption / decryption functions;

[0014] Select a hash function for the service list used to process NF nodes;

[0015] Generate attribute public keys and master keys based on attribute-based encryption algorithms.

[0016] Among some possible implementations of the first aspect, the method also includes:

[0017] Based on the registration information of the NF node, the IP address of the NF node is encrypted using a symmetric key to form the corresponding ciphertext;

[0018] Based on the registration information of the NF node, the service list of the NF node is hashed using the selected hash function to obtain the corresponding hash value;

[0019] The ciphertext and hash value are processed separately to generate key-value pairs, which are then uploaded to the CSP so that the NF node can obtain the ciphertext of the corresponding service's IP address through the CSP.

[0020] In some possible implementations of the first aspect, responding to a registration request sent by an NF node from a secure channel verifies the registration information carried in the registration request, including:

[0021] Receive the registration request sent by the NF node from the secure channel; the request carries the NF node's configuration file;

[0022] Based on the digital signature in the configuration file, the registration information carried in the registration request is verified using the certificate public key.

[0023] In some possible implementations of the first aspect, if verification is successful, an attribute private key corresponding to the configuration of the NF node is generated based on the current version number; and the attribute public key, attribute private key, hash function, symmetric key, and symmetric encryption / decryption function are sent to the NF node through a secure channel; so that NF nodes can establish communication through the attribute public key, attribute private key, hash function, and symmetric key, including:

[0024] If the verification is successful, an attribute private key corresponding to the configuration of the NF node will be generated according to the current version number; and the attribute public key, attribute private key, hash function, symmetric key and symmetric encryption / decryption function will be sent to the NF node through a secure channel.

[0025] This allows the NF node to obtain the hash value corresponding to the service to be accessed based on the hash function, use the hash value to obtain the ciphertext of the service IP address through the CSP, and decrypt the ciphertext of the IP address using the symmetric key to obtain the service IP address. Then, an access request is sent to the service IP address to establish communication with the NF node where the service IP address resides.

[0026] The NF node receiving the access request will send the encrypted temporary session key to the NF node, so that the NF node can use its attribute private key to decrypt the encrypted temporary session key, obtain the temporary session key, and use the temporary session key to establish communication with the NF node receiving the access request to achieve the purpose of accessing the corresponding service.

[0027] In some possible implementations of the first aspect, the ciphertext and hash value are processed separately to generate key-value pairs, including:

[0028] Generate key-value pairs by using the hash value as the key and the ciphertext as the value, and then upload the key-value pairs to the CSP.

[0029] Among the possible implementations of the first aspect, the method also includes:

[0030] Digital signatures are performed when key-value pairs are uploaded to the CSP.

[0031] Among some possible implementations of the first aspect, the method also includes:

[0032] Set the key update cycle;

[0033] Update the attribute version number during the key update cycle and send the latest attribute version number to the NF node through a secure channel so that the NF node can update the attribute version number;

[0034] Receive the configuration file sent by the NF node after updating the attribute version number, and compare the configuration file sent by the NF node after updating the attribute version number with the configuration file sent before updating the attribute version number.

[0035] If the two configuration files are identical, then a private key extension related to the latest attribute version will be generated for the NF node;

[0036] If the two configuration files are different, a new attribute private key will be generated for the NF node.

[0037] According to a second aspect of the present invention, a decentralized network service management system is provided, the system being applied to a management server, the management server including an NRF node, the system comprising:

[0038] The first processing unit is used to establish a secure channel between the network domain security mechanism and the NF node.

[0039] The second processing unit is used to respond to the registration request sent by the NF node from the secure channel and verify the registration information carried in the registration request;

[0040] The third processing unit, if the verification is successful, generates an attribute private key corresponding to the configuration of the NF node based on the current version number; and sends the attribute public key, attribute private key, hash function, symmetric key and symmetric encryption / decryption function to the NF node through a secure channel; so that NF nodes can establish communication with each other through the attribute public key, attribute private key, hash function and symmetric key.

[0041] According to a third aspect of the present invention, an electronic device is provided. The electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the method described above.

[0042] In this invention, an attribute-based encryption algorithm is used to generate an attribute public key and a master key, enabling network service providers with the attribute public key to embed access policies into the ciphertext, thereby achieving distributed access control. A tree-structured access control policy is adopted to achieve flexible and fine-grained service access control. Dynamic version numbers are used to manage keys, enabling fast and efficient key updates and saving the overhead of repeatedly generating keys.

[0043] It should be understood that the description in the Summary of the Invention is not intended to limit the key or essential features of the embodiments of the present invention, nor is it intended to restrict the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0044] The above and other features, advantages, and aspects of the various embodiments of the present invention will become more apparent from the accompanying drawings and the following detailed description. The drawings are provided for a better understanding of the invention and are not intended to limit the invention. In the drawings, the same or similar reference numerals denote the same or similar elements, wherein:

[0045] Figure 1 A flowchart of a decentralized network service management method provided by an embodiment of the present invention is shown;

[0046] Figure 2This diagram illustrates the interaction between NRF nodes, NF nodes, CSP initialization, and NF node registration in a decentralized network service management method provided by an embodiment of the present invention.

[0047] Figure 3 This diagram illustrates the interaction between decentralized NF node authorization, access control, and key update in a decentralized network service management method provided by an embodiment of the present invention.

[0048] Figure 4 A schematic diagram of an exemplary structure tree provided in an embodiment of the present invention is shown;

[0049] Figure 5 A schematic diagram of a decentralized network service management system provided by an embodiment of the present invention is shown;

[0050] Figure 6 A block diagram of a decentralized network service management system provided by an embodiment of the present invention is shown;

[0051] Figure 7 A block diagram of an exemplary electronic device capable of implementing embodiments of the present invention is shown. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0053] Furthermore, the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0054] In response to the problems mentioned in the background art, the present invention provides a decentralized network service management method, system and device.

[0055] Specifically, a secure channel is established between the network domain security mechanism and the NF node; a registration request sent by the NF node from the secure channel is responded to, and the registration information carried in the registration request is verified; if the verification is successful, an attribute private key corresponding to the configuration of the NF node is generated according to the current version number; and the attribute public key, attribute private key, hash function, symmetric key and symmetric encryption / decryption function are sent to the NF node through the secure channel so that the NF nodes can establish communication with each other through the attribute public key, attribute private key, hash function and symmetric key.

[0056] This approach distributes service access control permissions, previously centralized at the NRF node, to each network service provider. Even when the NRF is offline, service access control between NF nodes in the core network can continue securely and normally, resolving efficiency bottlenecks caused by NRF node performance issues and mitigating the harm caused by NRF node failures. When network service providers change service access policies, they no longer need to go through the NRF node; they can modify access policies directly and in real time. This makes network service access policies easier to understand and maintain, better supports hierarchical permission management, and achieves flexible, fine-grained service access control.

[0057] The following description, in conjunction with the accompanying drawings and specific embodiments, provides a more detailed account of a decentralized network service management method, system, and device provided by the present invention.

[0058] Figure 1 A flowchart of a decentralized network service management method provided by an embodiment of the present invention is shown; as follows: Figure 1 As shown, a decentralized network service management method 100 may include the following steps:

[0059] S110 establishes a secure channel between itself and NF nodes based on network domain security mechanisms.

[0060] In some embodiments, before / simultaneously establishing a secure channel between the network domain security mechanism and the NF node, method 100 further includes:

[0061] Generate the current version number, configure the digital certificate, and upload the certificate's public key to the CSP so that the CSP can verify it when storing key-value pairs on the NRF node. Configuring the digital certificate and uploading the certificate's public key to the CSP includes: obtaining and configuring the digital certificate through a CA (Certificate Authority); and uploading the public key of the digital certificate to the CSP.

[0062] Generate symmetric keys for encrypting / decrypting NF nodes based on encryption / decryption functions;

[0063] Select a hash function for the service list used to process NF nodes;

[0064] Generate attribute public keys and master keys based on attribute-based encryption algorithms.

[0065] When CSP is initialized, it needs to store the NRF's certificate public key for subsequent verification of the NRF's identity.

[0066] In some embodiments, method 100 further includes:

[0067] Based on the registration information of the NF node, the IP address of the NF node is encrypted using a symmetric key to form the corresponding ciphertext;

[0068] Based on the registration information of the NF node, the service list of the NF node is hashed using the selected hash function to obtain the corresponding hash value;

[0069] The ciphertext and hash value are processed separately to generate key-value pairs, which are then uploaded to the CSP so that the NF node can obtain the ciphertext of the corresponding service's IP address through the CSP.

[0070] Furthermore, the ciphertext and hash value are processed separately to generate key-value pairs, including:

[0071] Generate key-value pairs by using the hash value as the key and the ciphertext as the value, and then upload the key-value pairs to the CSP.

[0072] S120: Respond to the registration request sent by the NF node from the secure channel and verify the registration information carried in the registration request.

[0073] Specifically, it receives a registration request sent by an NF node through a secure channel; the request carries the NF node's configuration file; and verifies the registration information carried in the registration request using the CA certificate public key based on the digital signature in the configuration file.

[0074] S130, if the verification is successful, generate an attribute private key corresponding to the configuration of the NF node according to the current version number; and send the attribute public key, attribute private key, hash function, symmetric key and symmetric encryption / decryption function to the NF node through a secure channel; so that the NF nodes can establish communication with each other through the attribute public key, attribute private key, hash function and symmetric key.

[0075] Specifically, if the verification is successful, an attribute private key corresponding to the configuration of the NF node is generated according to the current version number; and the attribute public key, attribute private key, hash function, symmetric key and symmetric encryption / decryption function are sent to the NF node through a secure channel;

[0076] This allows the NF node to obtain the hash value corresponding to the service to be accessed based on the hash function, use the hash value to obtain the ciphertext of the service IP address through the CSP, and decrypt the ciphertext of the IP address using the symmetric key to obtain the service IP address. Then, an access request is sent to the service IP address to establish communication with the NF node where the service IP address resides.

[0077] The NF node receiving the access request will send the encrypted temporary session key to the NF node, so that the NF node can use its attribute private key to decrypt the encrypted temporary session key, obtain the temporary session key, and use the temporary session key to establish communication with the NF node receiving the access request to achieve the purpose of accessing the corresponding service.

[0078] In some embodiments, the method further includes:

[0079] Set the key update cycle;

[0080] Update the attribute version number during the key update cycle and send the latest attribute version number to the NF node through a secure channel so that the NF node can update the attribute version number;

[0081] Receive the configuration file sent by the NF node after updating the attribute version number, and compare the configuration file sent by the NF node after updating the attribute version number with the configuration file sent before updating the attribute version number.

[0082] If the two configuration files are identical, then a private key extension related to the latest attribute version will be generated for the NF node;

[0083] If the two configuration files are different, a new attribute private key will be generated for the NF node.

[0084] The following is combined with Figure 2 — Figure 3 The present invention will be described in detail with reference to an embodiment of a decentralized network service management method.

[0085] Figure 2 This diagram illustrates the interaction between NRF nodes, NF nodes, CSP initialization, and NF node registration in a decentralized network service management method provided by an embodiment of the present invention.

[0086] It should be noted that, as Figure 2 As shown, the core network elements included in this embodiment of the invention include:

[0087] Network service requester (cNF node): A module that accesses services provided by other network functions (i.e., other NF nodes).

[0088] Network service provider pNF node: A module that provides services and supports access by other network functions (i.e., other NF nodes).

[0089] Network storage function (NRF) node: It has functions such as service discovery, management, and authorization. In this embodiment of the invention, it also has the function of generating and distributing attribute encryption-related keys.

[0090] Cloud Service Provider (CSP): Stores the hash of the storage name and the ciphertext of the IP address in key-value pairs.

[0091] like Figure 2 As shown, the NRF node, NF node, and CSP are initialized, digital certificates are configured through a CA authority, and a secure channel is established through a network domain security mechanism (e.g., NDS / IP). Simultaneously, the NRF node generates the version parameter v, attribute public key PK, master key MK, and symmetric key K. IP Hash function (Hash), symmetric encryption / decryption functions (enc & dec).

[0092] like Figure 2 As shown, Network Functions (NF) i (That is, the pNF node in the above NF nodes) sends a registration request to the NRF node through the secure channel established by NDS, which includes the NF node's registration information. i The configuration file includes:

[0093] NF i Type NF i，type Instance identity identifier NF i，id Network address NF i，address ServiceList i ={Service i，1 Service i，2 Service i，n (There are n services here), and each service has a defined access policy (AP). i ={AP i，1 AP i，2 AP i，m Information such as (there are m access policies here).

[0094] NRF nodes based on NF i The configuration file and version number v generate the attribute private key SK i，v For Service i，k NRF calculation of Hash (Service) i，k ), and Hash(Service) i，k ) as a key, The message is sent to the CSP as a key-value pair and digitally signed.

[0095] The CSP verifies the message using the NRF node's public key; if verification is successful, it stores the key-value pair.

[0096] NRF nodes transmit attribute public key PK and private key SK through a secure channel. i，v Symmetric key K IP The encryption / decryption algorithm enc&dec is sent to NF. i .

[0097] The above registration process is illustrated using a pNF node as an example. It can be understood that the registration process for a cNF node is the same as that for a pNF node, so it will not be described again here.

[0098] Figure 3 This diagram illustrates the interaction between decentralized NF node authorization, access control, and key update in a decentralized network service management method provided by an embodiment of the present invention.

[0099] like Figure 3 As shown, decentralized NF node authorization and access control can specifically include the following steps:

[0100] The cNF node performs a hash operation on the service name ServiceName of the accessed service to obtain Hash(ServiceName), and then sends an IP query request to the CSP.

[0101] After receiving the query request, the CSP uses key-value pairs to look up the encrypted enc(IP) of the IP address corresponding to the requested service. pNF K IP The encrypted message is then returned to the CNF node.

[0102] After receiving the address ciphertext, the CNF uses the IP key K IP Decrypt the ciphertext to obtain the IP address of the requested service. pNF =dec(enc(IP) pNF K IP ), K IP The cNF sends a service access request to the pNF node through this IP address, and the request includes the requested service name.

[0103] After receiving a service access request, the pNF node randomly generates a temporary session key (SessionKey) and queries the access policy of the requested service. Based on the service's access policy and the current attribute version number (v), the pNF node encrypts the SessionKey using the attribute public key (PK) and sends the encrypted ciphertext to the cNF node.

[0104] After receiving the ciphertext, the CNF node uses the attribute private key SK cNF，vThe ciphertext is decrypted to obtain the SessionKey, which is then used to securely communicate with the pNF node and access the services provided by the pNF node.

[0105] like Figure 3 As shown, key updates can specifically include the following steps:

[0106] The NRF node updates the attribute version number v′ = v + 1 and sends it to the NF node via a secure channel. i Send the latest attribute version number v′.

[0107] NF i Upon receiving the attribute version number v′, it is compared with the existing version number. If v′ > v, the attribute version number is updated to v′, and the current configuration file information is sent to NRF.

[0108] Received NF i After configuring the configuration file, the NRF node compares the NF. i If the current configuration file is the same as the configuration file before the version update, then it is NF. i Generate a private key extension SK associated with version v′ appendix If NF i If the configuration file has been changed since the version update, then it is NF. i A new attribute private key is generated. Subsequently, NRF transmits the key to NF via a secure channel. i Send a key update message, which contains a private key expansion or a new private key.

[0109] NF i Upon receiving a key update message, check the key update type; if it is a private key expansion (SK)... appendix Then change the attribute private key to SK. i，v′ =SK i，v ∪{SK appendix If it is a new attribute private key, then update the attribute private key to SK. i，v′ .

[0110] According to embodiments of the present invention, a ciphertext policy attribute encryption scheme is adopted to achieve decentralized network function service access control, supporting network functions to autonomously update access control policies and providing security protection for NRF nodes in offline states. Employing a tree-structured control scheme, network service providers can more flexibly set access control policies, achieving flexible and fine-grained access control. The innovative introduction of the concept of attribute versioning effectively solves the attribute update problem, enabling efficient and flexible attribute addition, modification, and revocation, as well as secure attribute key management.

[0111] The following is combined with Figure 4 The above content will be described in more detail by another specific embodiment from multiple perspectives.

[0112] It should be noted that when using Ciphertext Policy Attribute-Based Encryption (CP-ABE) to implement secure access control for network services, some symbols and their meanings are as follows:

[0113]

[0114]

[0115] In this embodiment, the decentralized network service management method may specifically include the following steps:

[0116] Step 1: System Initialization

[0117] 1. The NRF and NF nodes are initialized, certificates are configured, and Network Domain Security (NDS) is established through the certification authority in the network domain for subsequent establishment of secure channels.

[0118] 2. The NRF node generates version number v=0 and runs the initialization program of the attribute encryption system, selecting a p-order bilinear group with generator g. (where p is a prime number), from the ring of integers Two exponents, α and β, are randomly selected from {0, 1}. * arrive The mapping H is used to obtain the public key: The system master key is MK = {β, g} α}

[0119] 3. The NRF node selects the hash function Hash and the symmetric encryption function enc&dec, and generates the symmetric key K. IP .

[0120] 4. CSP initialization: Store the public key of the NRF node's certificate and configure the certificate.

[0121] Step 2: Network Function (NF) Node Registration and Key Distribution

[0122] Network Functions (NF) i Send a registration request message to the NRF node via a secure channel, which includes the NF i configuration file That is, NF i Type NF i，type Instance identity identifier NF i，id Network address NF i，IP ServiceList i ={Servicei，1 Service i，2 Service i，3 ...Service i，n (There are n services here), and each service has a defined access policy (AP). i ={AP i，1 AP i，2 AP i，3 AP i，m (There are m access strategies here).

[0123] According to NF i Generate a private key using the configuration file and version number v. Based on NF... i Generate a private key using the configuration file and version number v. Based on NF... i The configuration generates an AttributeSet. i =Attribute i，1 Attribution i，2 Attribute i，3 , ..., Attribute i，m (There are m attributes here), and this set of attributes is "positive", that is, Attribute. i，k This indicates that the attribute is possessed. The AttributeSet can be obtained from the set U of all positive attributes. i supplement The set of attributes S for generating the private key i By AttributeSet i , Jointly determined: Where -x indicates that the attribute x is not present. Ultimately, the NRF node is determined based on S. i For NF i Generate private key Where, r, r k For different random numbers.

[0124] NRF node will ServiceList i The service name of the service is hashed to obtain Hash(ServiceName). i，k ), and calculate ciphertext Combine the two into a key-value pair, digitally sign it using the private key in the NRF node certificate, and then send the key-value pair and digital signature to the CSP.

[0125] CSP verifies the digital signature using the public key in the NRF node certificate, and stores the key-value pair upon successful verification.

[0126] The NRF node establishes a secure channel through NDS to transmit SK. i，v v, PK, IP key enc&dec sent to NF i .

[0127] Step 3: Decentralized Network Function Service Authorization and Access Control

[0128] 1. The service requested by the cNF node. i，k ServiceName i，k Perform a hash operation to obtain Hash(ServiceName) i，k Send an IP lookup request to the CSP, which includes the Hash(ServiceName) i，k ).

[0129] 2. The CSP receives the Hash(ServiceName) i，k The service uses key-value pairs to look up the encrypted enc(IP) value of the corresponding IP address. pNF K IP Send it to the cNF node.

[0130] 3. The CNF node receives enc(IP) pNF K IP Then, using the symmetric key K IP Decrypt to obtain the IP address pNF =dec(enc(IP) pNF K IP ), K IP The cNF node sends a service access request to the pNF node through this IP address, and the request includes the requested service name.

[0131] 4. pNF randomly generates a temporary session key, SessionKey, and encrypts it using the attribute public key PK according to the service's access policy and version number v. An access structure tree can be designed during encryption. Each leaf node represents a specific attribute. The set of attributes used during encryption can be specifically represented as follows:

[0132] S i ={A1, A2, ..., A m}∪{-A m+1 -A m+2 ,...,-A m+n}∪{v},

[0133] Among them, A k -A indicates that it has a certain attribute. kThis indicates that the attribute is not present; 'v' represents the version number. For each node x in the equation, select a polynomial q. x Let k x It is the threshold for node x, that is, among the child nodes of x, at least k are required. x Only if all child nodes meet the requirements can the conditions specified by node x be satisfied. (Polynomial q) x The number of times is k x -1, and randomly generate k x -1 coefficient. For the root node x1, generate randomly. And order For other nodes, q x =q parent (x)(index(x)).

[0134] Figure 4 A schematic diagram of an exemplary structure tree provided in an embodiment of the present invention is shown; as follows: Figure 4 The diagram shows a structure tree for a version with parameter v that requires both A1 and A2 to be satisfied or A3 to be satisfied.

[0135] Let the set of all leaf nodes be denoted as If plaintext M = SessionKey, then the ciphertext is:

[0136] The pNF node sends the CT to the cNF node.

[0137] 5. After receiving CT, cNF uses its own private key SK i，v Decryption is required. An iterative method is needed for decryption; the specific decryption steps are as follows:

[0138] If x is a leaf node and i = att(x) ∈ S,

[0139] but

[0140] If x is a leaf node and but If x is a non-leaf node, let if Then F x =⊥, otherwise

[0141]

[0142] at last, You can then obtain the session key.

[0143] 6. The cNF node uses the SessionKey to communicate securely with the pNF node to complete the access service function.

[0144] Step 4: Key Update

[0145] 1. The NRF node changes its current version number to v′ = v+1, and proves its identity through NDS, sending a message to each NF. i Send a version update request, which includes the version number v′.

[0146] 2.NF i Verify the identity of the NRF node. If verification is successful, update the version number to v′ and send the current configuration file information, including NF, to the NRF node. i Type NF i，type Instance identity identifier NF i，id Network address NF i，IP wait.

[0147] 3. NRF node verification NF i The current configuration file, if ProfileList' i With ProfileList' i If they are the same, then it is NF. i Generate private key extensions associated with version v′ Where r is NF in step two i Specifically generated, Is Randomly selected from ProfileList'. i With ProfileList' i If they are different, then it is NF. i Regenerate a new attribute private key NRF nodes send expanded or new private keys to the NF via a secure channel. i .

[0148] If NF i SK was received appendix Then update the attribute private key to SK′ i，v =SK i，v ∪{SK appendix}; If NF i What I received was SK' i，v Then it will be used as a new attribute private key.

[0149] According to embodiments of the present invention, this method enables both the rapid revocation of access rights to outdated keys and the fast and efficient updating of keys. With most network function configurations remaining unchanged, there is no need to regenerate the complete attribute private key, significantly reducing overhead.

[0150] It should be noted that the decentralized network service management method, system and device provided in this embodiment of the invention can be applied to 5G / 6G or other similar network environments.

[0151] According to embodiments of the present invention, the following beneficial effects are achieved:

[0152] 1. Distributing service access control permissions, centralized in the NRF, to each network service provider. This enables secure and normal service access control between NFs in the core network even when the NRF is offline, resolving the efficiency bottleneck caused by NRF performance issues and reducing the harm caused by NRF failures. When network service providers change service access policies, they no longer need to go through the NRF; they can change access policies directly and in real time.

[0153] 2. It makes network service access policies easier to understand and maintain, and better supports hierarchical permission management, achieving flexible and fine-grained service access control.

[0154] 3. It can quickly revoke access permissions for outdated keys while also making key updates fast and efficient. With most network function configurations remaining unchanged, there is no need to regenerate the complete attribute private key, significantly saving overhead.

[0155] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0156] The above is an introduction to the method embodiments. The present invention will be further described below through system embodiments.

[0157] Figure 5 This diagram illustrates a decentralized network service management system provided by an embodiment of the present invention; as shown. Figure 5As shown, in the decentralized network service management system, functional entities first initialize and obtain digital certificates from certification authorities (CAs) within the network. Secure channels are established between network functions through Network Domain Security (NDS / IP) mechanisms. The NRF node initializes the attribute-based encryption system, generating a system public key and a master key. Simultaneously, the NRF node generates a symmetric key for encrypting and decrypting the network function (NF) node address and selects a hash function to hash the NF service name. After system initialization, the NF node sends a registration request to the NRF through the secure channel, sending configuration file information, supported services, etc. The NRF node verifies the NF node's registration information. Upon successful verification, it generates an attribute private key corresponding to the NF node's configuration and sends the attribute public key, attribute private key, selected hash function, and the symmetric key used for encrypting and decrypting the IP address to the NF node through the secure channel. Simultaneously, the NRF node calculates the NF node's service name using the hash function specified during initialization and encrypts its IP address using the symmetric key. The hash value of the service name and the ciphertext of the IP address form a key-value pair, which is then uploaded by the NRF node to the CSP. When a cNF node accesses a pNF node's service, it needs to find the service's IP address from the CSP to access the pNF node. The pNF node specifies the configuration requirements for accessing the service, sets up the access control policy structure, encrypts the temporary session key using its attribute public key, and sends the encrypted temporary session key to the cNF node. The cNF node uses its own attribute private key to decrypt the encrypted key, obtains the temporary session key, and uses this session key to communicate with the pNF node, thus achieving the purpose of accessing the service.

[0158] Figure 6 This diagram illustrates a block diagram of a decentralized network service management system provided by an embodiment of the present invention; as shown. Figure 6 As shown, a decentralized network service management system 600 may include:

[0159] The first processing unit 610 is used to establish a secure channel between the network domain security mechanism and the NF node;

[0160] The second processing unit 620 is used to respond to the registration request sent by the NF node from the secure channel and verify the registration information carried in the registration request;

[0161] The third processing unit 630 is used to generate an attribute private key corresponding to the configuration of the NF node according to the current version number if the verification is successful; and send the attribute public key, attribute private key, hash function, symmetric key and symmetric encryption / decryption function to the NF node through a secure channel so that the NF nodes can establish communication with each other through the attribute public key, attribute private key, hash function and symmetric key.

[0162] It is understood that each module / unit in the decentralized network service management system 600 has the function of implementing each step in the decentralized network service management method 100 provided in the embodiments of the present invention, and can achieve its corresponding technical effect. For the specific working process, please refer to the corresponding process in the foregoing method embodiments. For the sake of convenience and brevity, it will not be repeated here.

[0163] According to embodiments of the present invention, an electronic device is also provided.

[0164] Figure 7 A block diagram of an exemplary electronic device capable of implementing embodiments of the present invention is shown. For example... Figure 7 As shown, electronic device 700 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0165] Electronic device 700 includes a computing unit 701, which can perform various appropriate actions and processes according to a computer program stored in ROM 702 or a computer program loaded into RAM 703 from storage unit 708. RAM 703 can also store various programs and data required for the operation of electronic device 700. The computing unit 701, ROM 702, and RAM 703 are interconnected via bus 704. I / O interface 705 is also connected to bus 704.

[0166] Multiple components in electronic device 700 are connected to I / O interface 705, including: input unit 706, such as keyboard, mouse, etc.; output unit 707, such as various types of displays, speakers, etc.; storage unit 708, such as disk, optical disk, etc.; and communication unit 709, such as network card, modem, wireless transceiver, etc. Communication unit 709 allows electronic device 700 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0167] The computing unit 701 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 701 performs the various methods and processes described above, such as method 100. For example, in some embodiments, method 100 may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 700 via ROM 702 and / or communication unit 709. When the computer program is loaded into RAM 703 and executed by the computing unit 701, one or more steps of method 100 described above may be performed. Alternatively, in other embodiments, the computing unit 701 may be configured to perform method 100 by any other suitable means (e.g., by means of firmware).

[0168] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0169] The program code used to implement the methods of the present invention can be written in any combination of one or more programming languages. This program code can be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0170] It should be understood that the various forms of processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this invention can be achieved, and this is not limited herein.

[0171] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A decentralized network service management method, characterized in that, The method is applied to a management server, the management server including an NRF node, and the method includes: During initialization, the NRF node generates version parameters, attribute public key, master key, symmetric key, hash function, and symmetric encryption / decryption function; NRF nodes generate version parameters, attribute public keys, master keys, symmetric keys, and hash functions, including: Generate the current version number, configure the digital certificate, and upload the certificate public key to the CSP so that the CSP can verify it when storing key-value pairs on the NRF node; Generate symmetric keys for encrypting / decrypting NF nodes based on encryption / decryption functions; Select a hash function for the service list used to process NF nodes; Generate an attribute public key and a master key based on an attribute-based encryption algorithm; Establish a secure channel between the network domain security mechanism and the NF node; In response to the registration request sent by the NF node from the secure channel, verify the registration information carried in the registration request; If the verification is successful, an attribute private key corresponding to the configuration of the NF node is generated according to the current version number; and the attribute public key, attribute private key, hash function, symmetric key and symmetric encryption / decryption function are sent to the NF node through the secure channel so that the NF nodes can establish communication with each other through the attribute public key, attribute private key, hash function and symmetric key; If the verification is successful, an attribute private key corresponding to the configuration of the NF node is generated according to the current version number; and the attribute public key, attribute private key, hash function, symmetric key, and symmetric encryption / decryption function are sent to the NF node through the secure channel; so that the NF nodes can establish communication through the attribute public key, attribute private key, hash function, and symmetric key, including: If the verification is successful, an attribute private key corresponding to the configuration of the NF node is generated according to the current version number; and the attribute public key, attribute private key, hash function, symmetric key and symmetric encryption / decryption function are sent to the NF node through the secure channel; So that the NF node can obtain the hash value corresponding to the service to be accessed according to the hash function, use the hash value corresponding to the service to be accessed to obtain the ciphertext of the service IP address through the CSP, and decrypt the ciphertext of the IP address according to the symmetric key to obtain the IP address of the service, and send an access request to the IP address of the service to establish communication with the NF node where the IP address of the service is located. The process involves the NF node obtaining the hash value corresponding to the service to be accessed based on the hash function, and using the hash value of the service to be accessed to obtain the ciphertext of the service IP address through the CSP, including: Based on the registration information of the NF node, the IP address of the NF node is encrypted using the symmetric key to form the corresponding ciphertext; Based on the registration information of the NF node, the service list of the NF node is hashed using the selected hash function to obtain the corresponding hash value; The ciphertext and the hash value are processed separately to generate key-value pairs, and the key-value pairs are uploaded to the CSP so that the NF node can obtain the ciphertext of the IP address of the corresponding service through the CSP; In this process, the NF node receiving the access request will send the ciphertext of the temporary session key, which is encrypted using the attribute public key, to the NF node. The NF node can then use the attribute private key to decrypt the ciphertext of the temporary session key, obtain the temporary session key, and use the temporary session key to establish communication with the NF node receiving the access request, thereby achieving the purpose of accessing the corresponding service.

2. The method according to claim 1, characterized in that, The response to the registration request sent by the NF node from the secure channel, verifying the registration information carried in the registration request, includes: Receive the registration request sent by the NF node from the secure channel; the request carries the configuration file of the NF node; Based on the digital signature in the configuration file, the registration information carried in the registration request is verified using the certificate public key.

3. The method according to claim 1, characterized in that, The step of processing the ciphertext and the hash value respectively to generate key-value pairs includes: The hash value is used as the key and the ciphertext is used as the value to generate key-value pairs, and the key-value pairs are uploaded to the CSP.

4. The method according to claim 1, characterized in that, The method further includes: When the key-value pair is uploaded to the CSP, it is digitally signed.

5. The method according to claim 1, characterized in that, The method further includes: Set the key update cycle; The attribute version number is updated during the key update cycle, and the latest attribute version number is sent to the NF node through a secure channel so that the NF node can update the attribute version number. Receive the configuration file sent by the NF node after updating the attribute version number, and compare the configuration file sent by the NF node after updating the attribute version number with the configuration file sent before updating the attribute version number; If the two configuration files are identical, then a private key extension related to the latest attribute version is generated for the NF node; If the two configuration files are different, a new attribute private key will be generated for the NF node.

6. A decentralized network service management system, characterized in that, The system is applied to a management server, the management server including an NRF node, and the system includes: The first processing unit is used for initialization, where the NRF node generates version parameters, attribute public key, master key, symmetric key, hash function, and symmetric encryption / decryption function; NRF nodes generate version parameters, attribute public keys, master keys, symmetric keys, and hash functions, including: Generate the current version number, configure the digital certificate, and upload the certificate public key to the CSP so that the CSP can verify it when storing key-value pairs on the NRF node; Generate symmetric keys for encrypting / decrypting NF nodes based on encryption / decryption functions; Select a hash function for the service list used to process NF nodes; Generate an attribute public key and a master key based on an attribute-based encryption algorithm; Establish a secure channel between the network domain security mechanism and the NF node; The second processing unit is used to respond to the registration request sent by the NF node from the secure channel and verify the registration information carried in the registration request; The third processing unit is used to generate an attribute private key corresponding to the configuration of the NF node according to the current version number if the verification is successful; and send the attribute public key, attribute private key, hash function, symmetric key and symmetric encryption / decryption function to the NF node through the secure channel; so that the NF nodes can establish communication with each other through the attribute public key, attribute private key, hash function and symmetric key; If the verification is successful, an attribute private key corresponding to the configuration of the NF node is generated according to the current version number; and the attribute public key, attribute private key, hash function, symmetric key, and symmetric encryption / decryption function are sent to the NF node through the secure channel; so that the NF nodes can establish communication through the attribute public key, attribute private key, hash function, and symmetric key, including: If the verification is successful, an attribute private key corresponding to the configuration of the NF node is generated according to the current version number; and the attribute public key, attribute private key, hash function, symmetric key and symmetric encryption / decryption function are sent to the NF node through the secure channel; So that the NF node can obtain the hash value corresponding to the service to be accessed according to the hash function, use the hash value corresponding to the service to be accessed to obtain the ciphertext of the service IP address through the CSP, and decrypt the ciphertext of the IP address according to the symmetric key to obtain the IP address of the service, and send an access request to the IP address of the service to establish communication with the NF node where the IP address of the service is located. The process involves the NF node obtaining the hash value corresponding to the service to be accessed based on the hash function, and using the hash value of the service to be accessed to obtain the ciphertext of the service IP address through the CSP, including: Based on the registration information of the NF node, the IP address of the NF node is encrypted using the symmetric key to form the corresponding ciphertext; Based on the registration information of the NF node, the service list of the NF node is hashed using the selected hash function to obtain the corresponding hash value; The ciphertext and the hash value are processed separately to generate key-value pairs, and the key-value pairs are uploaded to the CSP so that the NF node can obtain the ciphertext of the IP address of the corresponding service through the CSP; In this process, the NF node receiving the access request will send the ciphertext of the temporary session key, which is encrypted using the attribute public key, to the NF node. The NF node can then use the attribute private key to decrypt the ciphertext of the temporary session key, obtain the temporary session key, and use the temporary session key to establish communication with the NF node receiving the access request, thereby achieving the purpose of accessing the corresponding service.

7. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method described in any one of claims 1-5.

Images