Certificate management microservices

Abstract

A method of operating a cloud native function (CNF) includes receiving a configuration instruction at a certificate management microservice of the CNF. In response to the configuration instruction, the certificate management microservice is initialized, including writing a certificate containing a certificate key to the secure storage element. The certificate management micro-service receives a service request from other micro-services of the CNF, and in response to the service request, sends certificate information to the other micro-services, the certificate information being used by the other micro-services to read a certificate key from the secure storage element.

Description

[0001] Priority claim

[0002] This application claims priority to Indian Provisional Application No. IN202241056984 filed on October 4, 2022, the entire contents of which are incorporated herein by reference. Technical Field

[0003] The present disclosure relates to wireless communications, and more particularly to a certificate management microservice for distributed networking nodes in cloud-native radio access networks (RAN) and non-RAN applications. Background Art

[0004] Typically, cloud-native network architectures such as RAN and open RAN provide a large number of services and critical applications. Any disaggregated, virtualized, multi-vendor system with many big players is vulnerable to security vulnerabilities. When all software and hardware in the baseband were proprietary and provided by a single vendor, security mechanisms in traditional RAN and other networks were relatively simple. But this is not the case in new architectures such as cloud-native RAN.

[0005] In a cloud-native RAN (virtualized RAN or vRAN) or other network, the software can be decomposed and typically runs on off-the-shelf hardware, while in an open RAN or other open network, the software can come from many different vendors. In a cloud-native approach where network operations are based on cloud-native network functions (CNFs), the software is containerized and the baseband software is divided into containerized microservices: PHY, RLC, MAC, transport, and other functions. These microservices are typically organized in a Kubernetes cluster and must communicate securely with each other to work reliably. This communication can be managed by a cloud-native entity called a "service mesh", which consists of two parts: (1) a control plane, which establishes communication channels between microservices, and (2) a data plane, which manages the actual transmission of data. Microservices are heterogeneous and highly distributed, and can run on multiple different servers that are geographically and logically separated and can be provided by different providers, each providing different baseband functions. Summary of the invention

[0006] In some embodiments, a method of operating a CNF includes: receiving a configuration instruction at a certificate management microservice of the CNF, initializing the certificate management microservice in response to the configuration instruction, wherein initializing the certificate management microservice includes: writing a certificate including a certificate key into a secure storage element, receiving a service request from other microservices of the CNF at the certificate management microservice, and sending certificate information to the other microservices in response to the service request, wherein the certificate information is configured to be used by the other microservices to read the certificate key from the secure storage element.

[0007] In some embodiments, a method for managing digital certificates in a cloud network includes sending a service request from an active microservice of a CNF of the cloud network to a certificate management microservice of the CNF, sending certificate information from the certificate management microservice to the active microservice in response to receiving the service request, and reading a certificate key from a secure storage element using the active microservice based on the certificate information.

[0008] In some embodiments, a computer-readable medium includes instructions executable by a controller of a network device (e.g., a virtual network function (VNF)) to cause the controller to perform operations including: receiving configuration instructions at a certificate management microservice of the CNF, and instantiating the certificate management microservice in response to the configuration instructions, wherein instantiating the certificate management microservice includes: writing a certificate including a certificate key to a secure storage element, receiving a service request from other microservices of the CNF at the certificate management microservice, and sending certificate information to the other microservices in response to the service request, wherein the certificate information is configured to be usable by the other microservices to read the certificate key from the secure storage element. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] When read in conjunction with the accompanying drawings, aspects of the present disclosure are best understood from the following detailed description. According to standard practice in the industry, various features are not drawn to scale. In fact, the sizes of various features are arbitrarily increased or reduced for clarity of discussion.

[0010] Figure 1A and 1B is a diagram of a communication system according to some embodiments.

[0011] Figure 2 is a flow chart of a certificate management method according to some embodiments.

[0012] Figure 3 is a flow chart of a certificate management method according to some embodiments.

[0013] Figure 4 is a flow chart of a certificate management method according to some embodiments.

[0014] Figure 5is a diagram of a certificate management method according to some embodiments. DETAILED DESCRIPTION

[0015] The following disclosure provides many different embodiments or examples for implementing the different features of the provided subject matter. Specific examples of components and arrangements are described below to simplify the present disclosure. Of course, these are merely exemplary and non-restrictive. For example, in the subsequent description, the formation or positioning of a first feature on or above a second feature includes an embodiment in which the first and second features are formed or positioned to be in direct contact, and includes an embodiment in which an additional feature is formed or positioned between the first and second features so that the first and second features are in indirect contact. In addition, the present disclosure repeats reference numbers and / or letters in various examples. This repetition is for the purpose of simplicity and clarity, and does not itself indicate the relationship between the various embodiments and / or configurations discussed.

[0016] In addition, for ease of description, spatially relative terms such as "under," "beneath," and "below," "over," and "above," etc., are used herein for ease of description to describe the relationship of one element or feature to another element(s) or feature(s) as shown in the figures. Spatially relative terms are intended to encompass different orientations of the system or object in use or operation in addition to the orientation shown in the figures. The system may be otherwise oriented (rotated 90 degrees or in other orientations) and the spatially relative descriptors used herein are likewise interpreted accordingly.

[0017] In various embodiments, a method and computer-readable medium are directed to receiving a configuration instruction at a certificate management microservice of a CNF, initializing the certificate management microservice in response to the configuration instruction, wherein initializing the certificate management microservice includes: writing a certificate including a certificate key to a secure storage element, receiving a service request from other microservices of the CNF at the certificate management microservice, and sending certificate information to the other microservice in response to the service request, wherein the certificate information is configured to be used to read the certificate key from the secure storage element by the other microservice. In some embodiments, the method includes one or more of the following: sending a registration request from the certificate management microservice to a certification authority (CA), the registration request corresponding to an indicated certificate registration protocol; using the certificate management microservice to detect an elapsed time greater than a renewal threshold of the certificate; and in response to detecting that the elapsed time is greater than the renewal threshold, sending a registration renewal request from the certificate management microservice to the CA, and in some embodiments, the method includes sending an initial registration renewal request, and periodically sending subsequent registration renewal requests from the certificate management microservice to the CA.

[0018] By performing some or all of the method operations, the microservice level certificate manager can be easily encapsulated in RAN CNF, such as CUCP, CUUP, 5G DU, and non-RAN CNF, such as Kafka, EMS, FCAPS services, which require operator certificates, can be easily extended to support any new registration and re-registration protocols, provide gRPC and JSONAPI based interfaces for communicating with other microservices in CNF, can communicate with registration authorities (RA) and certification authorities (CA) for registration and re-registration controlled for different customer needs, and can support default certificates that can be used for customer lab trials and proofs of concept (POC) (for example, based on the lack of CA). Thus, the certificate management microservice supports multiple registration and re-registration protocols, such as algorithms selectable when instantiating CNF based on customer needs, re-registration of certificates within a configurable window before expiration, notification of changes to device certificates and keys to applications, authentication based on provider certificates and TLS-SRP equivalent methods for registration, single or multiple certificates for applications, use of secure vaults to store keys, changing certificate profiles corresponding to 3GPP and O-RAN specifications, and operator-specified alerts during registration or re-registration failures. Compared to other approaches (e.g., namespace-level or cluster-level certificate management provided by Kubernetes (K8)), digital certificates can be more widely and efficiently managed automatically in cloud native network applications, such as RAN and open RAN applications.

[0019] Figure 1A is a diagram of a network system 100 (hereinafter referred to as "system 100") according to some embodiments, and Figure 1B is a diagram of a portion of system 100 according to some embodiments. For ease of illustration, Figure 1A and Figure 1B Each diagram in is simplified.

[0020] System 100 includes a plurality of interconnected devices 102 configured as some or all of a network 104. In various embodiments, devices 102 correspond to computing devices, computing systems, servers, server clusters, and / or a combination of multiple server clusters also referred to in some embodiments as a server farm or data center. The combination of interconnected devices 102 includes processing circuitry configured to be operable to perform some or all of the various operations discussed herein.

[0021] In some embodiments, one or more of the devices 102 are virtualized network components, such as virtualized network functions (VNFs), such as cloud native network functions (CNFs), including software configured to implement one or more network functions by running on one or more hardware devices. In some embodiments, some or all of the devices 102 are configured as some or all of the infrastructure in a network function virtualization infrastructure (NFVI). Other configurations and / or types of devices 102 are also within the scope of the present disclosure.

[0022] Figure 1A Examples of device 102, device 102U, and CNF 120 are shown, each of which will also be discussed below.

[0023] In some embodiments, the network 104 includes one or more radio access networks (RANs) or portions of a RAN. In some embodiments, a RAN is a mobile telecommunication system that implements a radio access technology (RAT) and resides between instances of user equipment (UE) 112, such as mobile phones, computers, etc., and provides connectivity to the device 102. In some embodiments, the RAN is an open RAN (O-RAN).

[0024] In some embodiments, one or more of devices 102 are configured to perform management functions corresponding to network 104. In various embodiments, one or more of devices 102 are configured as one or more of: an operations support system (OSS), an element management system (EMS), a network management system (NMS), an access and mobility management function (AMF), or other systems or functions configured to perform one or more activities in support of operation of network 104.

[0025] In some embodiments, one or more of the interconnected devices 102 of the network 104 are configured as one or more of the following: a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), an Internet area network (IAN), a campus area network (CAN), or a virtual private network (VPN). In some embodiments, one or more of the interconnected devices 102 of the network 104 are configured as a backbone or core network (CN), i.e., part of a computer network of interconnected networks, providing a path for exchanging information between different LANs, WANs, etc.

[0026] In some embodiments, some of the interconnected devices 102 of the network 104 are configured as, for example, a server cluster included in a data center. In some embodiments, the server cluster is part of a cloud computing environment.

[0027] In some embodiments, network 104 is one or more of: Global System for Mobile Communications (GSM) RAN, GSM / EDGE RAN, Universal Mobile Telecommunications System (UMTS) RAN (UTRAN), Evolved Universal Terrestrial Radio Access Network (E-UTRAN), Open RAN (O-RAN), or Cloud RAN (C-RAN). In some embodiments, network 104 resides between UE 112 and one or more core networks of system 100.

[0028] In some embodiments, network 104 is some or all of a layered telecommunication network (e.g., system 100), including one or more intermediate links between a RAN and one or more core networks (also referred to as a backhaul portion in some embodiments). Non-limiting examples of mobile backhaul implementations include fiber-based backhaul, wireless point-to-point backhaul, copper-based wirelines, satellite communications, and point-to-multipoint wireless technologies. In some embodiments, backhaul refers to the network side that communicates with the global Internet.

[0029] exist Figure 1A In the illustrated embodiment, network 104 includes cells 106A and 106B, which include respective base stations 108A and 108B and respective antennas 110A and 110B. In some embodiments, network 104 includes cells 106A and 106B and a plurality of cells collectively referred to as cells 106, or in some embodiments includes coverage area 106, including base stations 108A and 108B and a plurality of base stations collectively referred to as base stations 108, and a plurality of antennas including antennas 110A and 110B and collectively referred to as antennas 110.

[0030] exist Figure 1A In the illustrated embodiment, a single base station 108 corresponds to a single instance of each of cell 106 and antenna 110. In various embodiments, a single base station 108 corresponds to more than one instance of cell 106 and / or more than one instance of antenna 110.

[0031] In some embodiments, the base station 108 is a grid or self-supporting tower, a guyed tower, a monopole tower, and a hidden tower (e.g., a tower designed to resemble a tree, a cactus, a water tower, a sign, a light standard, and other types of structures). In some embodiments, the base station 108 is a cellular-enabled mobile device site, where antennas and electronic communication equipment are typically placed on a radio mast, tower, or other raised structure to create a cell 106 (or adjacent cell) in the network. The raised structure typically supports (multiple) antennas 110 and one or more transmitters / receivers, transceivers, digital signal processors, control electronics, remote radio heads (RRHs), main and backup power supplies, and shelters. Other names for the base station 108 are known, such as base transceiver stations, mobile phone poles, or cellular towers. In some embodiments, the base station 108 is an edge device configured to wirelessly communicate with a UE 112. The edge device provides an entry point into the service provider's core network. Examples include routers, routing switches, integrated access devices (IADs), multiplexers, and various MAN and WAN access devices.

[0032] In at least one embodiment, an example of antenna 110 is a sector antenna, such as a directional microwave antenna with a sector radiation pattern, or a plurality of sector antennas, for example, configured to have a full-circle coverage area 106. In some embodiments, an example of antenna 110 is a circular antenna. In some embodiments, an example of antenna 110 operates at one or more microwave or ultra-high frequency (UHF) frequencies, such as in the range of 300 megahertz (MHz) to 7.2 gigahertz (GHz). In some embodiments, an example of antenna 110 operates at one or more frequencies in the range of 24.2 GHz to 71.0 GHz.

[0033] In various embodiments, the cell 106 is a three-dimensional space having a shape and size based on the configuration of the corresponding base station 108 (e.g., power level) and antenna 110 (e.g., number of sectors). In various embodiments, the cell 106 has a substantially spherical, hemispherical, conical, cylindrical, circular or elliptical disk, or other shapes corresponding to the base station and antenna configuration. In various embodiments, one or both of the shape or size of the cell 106 changes over time, for example, based on variable base station power levels and / or a variable number of activated antennas and / or antenna sectors. In some embodiments, the cell 106 is referred to as a macrocell, a microcell, a picocell, a femtocell, or a small cell. In some embodiments, the cell 106 is referred to as an indoor small cell (IDSC).

[0034] In some embodiments, the instance of UE 112 is a computer or computing system. In some embodiments, the instance of UE 112 has a liquid crystal display (LCD), light emitting diode (LED) or organic light emitting diode (OLED) screen interface, such as a graphical user interface that provides a touch screen interface with digital buttons and a keyboard or physical buttons and a physical keyboard. In some embodiments, the instance of UE 112 is connected to the Internet and interconnected with other devices. In some embodiments, the instance of UE 112 includes an integrated camera, the ability to place and receive voice and video phone calls, video games, and global positioning system (GPS) capabilities. In some embodiments, the instance of UE 112 executes as a virtual machine or allows third-party applications to run as containers. In some embodiments, an example of UE 112 is a computer (such as a tablet, a netbook, a digital media player, a digital assistant, a graphing calculator, a handheld game console, a handheld personal computer (PC), a laptop, a mobile Internet device (MID), a personal digital assistant (PDA), a pocket calculator, a portable media player, or an ultra-mobile PC), a mobile phone (such as a camera phone, a feature phone, a smart phone, or a tablet phone), a digital camera (such as a digital camcorder or a digital still camera (DSC), a digital video camera (DVC), or a front-facing camera), a pager, a personal navigation device (PND), a wearable computer (such as a calculator watch, a smart watch, a head-mounted display, a headset, or a biometric device), or a smart card.

[0035] UE 112 is configured to communicate with base station 108 via signals transmitted to and from antenna 110 .

[0036] The network 104 includes a plurality of network nodes, referred to in some embodiments as nodes or RAN nodes. In some embodiments, a node corresponds to one or more devices 102, a combination of one or more devices 102 and one or more base stations 108, or one or more base stations 108. In some embodiments, a node corresponds to a base station 108 as an example of a device 102.

[0037] In some embodiments, the node corresponds to a device 102 configured as a centralized unit (CU) and one or more base stations 108 configured as a distributed unit (DU). In some embodiments, the node is a next generation RAN (NG-RAN) node, such as a gNB and NG-eNB according to the 3GPP TS 38.300 specification.

[0038] The nodes are connected to each other and to a network management entity, such as an EMS or AMF, through various interfaces. In some embodiments, the interface between a node and a core network element is referred to as an NG interface. In some embodiments, the interface between various nodes (e.g., NG-RAN nodes) is referred to as an Xn interface.

[0039] exist Figure 1A In the illustrated embodiment, the device 102U is a device configured to deploy one or more applications to the network 104. The device 102U includes a storage device 114U configured to store a microservice generator 116U and configuration parameters 118U. Figure 1A In the illustrated embodiment, device 102U is a single instance of device 102. In some embodiments, device 102U includes more than one instance of device 102.

[0040] A storage device (e.g., storage device 114U) is one or more computer-readable, non-volatile storage media, including one or more dynamic memories (e.g., RAM, magnetic disks, writable optical disks, etc.) and static memories (e.g., ROM, CD-ROM, etc.), configured to store executable instructions that, when executed, perform the operations described herein to facilitate automated certificate management. In some embodiments, storage device 114U is also configured to store data associated with or generated by the execution of the operations, such as configuration parameters 118U.

[0041] exist Figure 1A In the illustrated embodiment, the storage device 114U is located on the device 102U. In some embodiments, the storage device 114U is partially or entirely located outside the device 102U, for example, located on one or more servers corresponding to the device 102U.

[0042] Microservice generator 116U is one or more sets of instructions configured to be executed on device 102U, whereby CNF 120 is deployed and / or managed on network 104. Configuration parameters 118U is a set of data records configured to be usable by CNF 120, as discussed below with respect to method 200.

[0043] CNF 120 is an application configured to execute one or more networking functions or applications of network 104. In some embodiments, CNF 120 includes a CU CNF or a DU CNF of a RAN or an O-RAN. In some embodiments, CNF 120 includes the following references Figure 1B One CNF among CNF 120A to CNF 120C discussed. In some embodiments, CNF 120 is a network application other than RAN or O-RAN.

[0044] CNF 120 includes a certificate management microservice 122 and an additional microservice 124. Each of the certificate management microservice 122 and the additional microservice 124 includes an instruction set configured to perform one or more networking functions as a component (e.g., pod) of CNF 120. The certificate management microservice 122 and the additional microservice 124 are configured to communicate with each other in operation through one or more application programming interfaces (APIs) (e.g., gRPC / JSON APIs).

[0045] The CNF 120 and the certificate management microservice 122 are configured to perform the following reference Figures 2 to 5 Some or all of the operations of method 200 are discussed.

[0046] exist Figure 1B In the illustrated embodiment, the system 100 includes a network 104 configured as a RAN or an O-RAN, the RAN or the O-RAN includes a CNF 120, three instances of CNFs 120A to 120C, and a device 102, an instance of a CA server 102CA. CNF 120A is configured as a gNB-CU-CP (control plane) CNF, CNF 120B is configured as a gNB-CU-UP (user plane) CNF, and CNF 120C is configured as a gNB-DU CNF.

[0047] CA server 102 CA includes one or more servers configured as a certification authority (CA), an entity configured to store, sign and issue digital certificates according to one or more enrollment procedures based on one or more certificate enrollment protocols.

[0048] Each CNF in CNF 120A to CNF 120C includes a certificate management microservice 122, an instance of certmgr, and additional microservices 124, uS-2 to uS-N, corresponding to a total of N microservices. Microservices CertMgr and uS-2 to uS-N are configured to communicate via gRPC messages in operation, such as sending and receiving service messages.

[0049] Each instance of CertMgr is configured to read and write digital certificate information (e.g., a digital certificate including a public key) to a corresponding instance of the secure vault SecVault, and each instance of microservices uS-2 to uS-N is configured to read digital information from a corresponding instance of the secure vault SecoVault.

[0050] Figure 1BIn the illustrated embodiment, each instance of the certificate is configured as a first microservice of the corresponding CNF 120A to CNF 120C. In some embodiments, one or more instances of the certificate are configured as different microservices of the corresponding CNF 120A to CNF 120C, such that the first microservice uS-1 is included in the additional microservice 124.

[0051] CNFs 120A to 120C including the CertMgr instance are configured to perform the following Figures 2 to 5 Some or all of the operations of method 200 are discussed.

[0052] System 100 includes one or more instances configured as described above to perform some or all of method 200 , whereby CNF 120 is configured to obtain the benefits discussed below with respect to method 200 .

[0053] Figure 2 2 is a flow chart of a certificate management method 200 according to some embodiments. The certificate management method 200, also referred to as method 200 or method of operating CNF in some embodiments, can be operated on a network system, such as the one described above with respect to Figure 1A and Figure 1B System 100 discussed.

[0054] Can be Figure 2 Additional operations may be performed before, during, between, and / or after the operations of the method 200 described in the specification, and only some other operations are briefly described herein. In some embodiments, other operation sequences of the method 200 are within the scope of the present disclosure. In some embodiments, one or more operations of the method 200 are not performed.

[0055] In some embodiments, some or all of the operations of method 200 are included in another method, for example, a method of operating a networked system. In some embodiments, some or all of the operations of method 200 discussed below are repeated, for example, as part of operating a networked system.

[0056] In some embodiments, some or all of the operations of method 200 discussed below can be performed automatically, for example, by CNF 120 including certificate management microservice 122, each of which is described above in detail. Figure 1A and Figure 1B A discussion was held.

[0057] The operation of method 200 is discussed below with reference to various features of system 100, which are also referenced above. Figure 1A and Figure 1B Let's discuss.

[0058] Figures 3 to 5A non-limiting example of execution of some or all of the operations of method 200 using an embodiment of system 100 as described below is shown.

[0059] At operation 210, in some embodiments, configuration instructions are received at a certificate management microservice of a CNF. In some embodiments, receiving the configuration instructions includes receiving a set of Day-0 parameters, such as the example Day-0 parameters given below in Table 1. In some embodiments, receiving the configuration instructions at the certificate management microservice of a CNF includes receiving configuration parameters 118U at a certificate management microservice 122 of CNF 120, such as a CertMgr of one of CNFs 120A to 120C.

[0060] In some embodiments, receiving configuration instructions at a certificate management microservice of a CNF includes deploying one or more of: a certificate management microservice, a CNF, or an application including the certificate management microservice and the CNF, such as by using a microservice generator 116U. In various embodiments, deploying one or more of the certificate management microservice, CNF, or application includes launching a new instance of the certificate management microservice, CNF, or application, or performing an update to an existing certificate management microservice, CNF, or application.

[0061] In some embodiments, deploying one or more of the certificate management microservices, CNFs, or applications includes initiating an operating mode in which one or more of the certificate management microservices, CNFs, or applications are configured to wait for receiving instructions.

[0062] In some embodiments, receiving the configuration instruction at the certificate management microservice includes receiving a push from a network device (eg, device 102U). In some embodiments, receiving the push from the network device includes receiving a push from a network operator.

[0063] At operation 220, in some embodiments, a certificate management microservice is initialized. In some embodiments, initializing the certificate management microservice includes initializing a certificate management microservice 122 of a CNF 120, such as a CertMgr of one of CNFs 120A to 120C.

[0064] In some embodiments, initializing the certificate management microservice corresponds to performing Day-0 operations. In some embodiments, initializing the certificate management microservice corresponds to instantiating one or more application pods.

[0065] In some embodiments, initializing the certificate management microservice is based on the received configuration instructions, such as configuration parameters 118U. In some embodiments, initializing the certificate management microservice is based on the Day-0 parameters of Table 1 below.

[0066]

[0067]

[0068] Table 1 Day-0 parameter examples

[0069] A non-limiting example of a Day-0 parameter set presented in Table 1 includes, for each Day-0 parameter listed in the first column, a description in the second column, and an indication in each subsequent column as to whether the Day-0 parameter needs to be defined for a corresponding one of four defined certificate enrollment protocols: VNF Certificate Management Protocol - Version 2 (CMPv2); VNF Secure Transport Enrollment (EST); Physical Network Function (PNF) (CMPv2); and PNF (EST). The parameters CA_FQDN / IP, CA_PORT, CA_subject_name, CA_PATH, shared secret, reference number, and root CA of the issuing CA are identifiers configured to enable communication with a certification authority (e.g., CA server 102CA). The protocol indication is configured to identify the certificate enrollment protocol, such as EST, CMP, CMPv2, or Simple Certificate Enrollment Protocol (SCEP). The parameters TLS username and TLS password are authentication parameters configured based on the Transport Layer Security (TLS) Secure Remote Password (SRP) operation using VNF EST. The parameter hostname is an identifier corresponding to the host NF (eg, CNF 120).

[0070] In some embodiments, initializing the certificate management microservice includes, for example, setting a certificate enrollment protocol in response to the received parameter set. In some embodiments, setting the certificate enrollment protocol includes setting a certificate enrollment protocol corresponding to one of EST, CMP, CMPv2, or SCEP.

[0071] In some embodiments, initializing the certificate management microservice includes: for example, determining whether to execute a certificate registration procedure based on a received configuration instruction. In some embodiments, determining whether to execute a certificate registration procedure includes: for example, determining that a CA or RA is unavailable based on one or more received parameters.

[0072] In some embodiments, initializing the certificate management microservice includes: authenticating the certificate management microservice to a secure storage element (e.g., a secure vault or a persistent volume such as a non-volatile memory). In some embodiments, authenticating the certificate management microservice to the secure storage element is based on one or more received parameters. In some embodiments, authenticating the certificate management microservice to the secure storage element includes authenticating the certificate management microservice to a secure vault SecVault of one of CNFs 120A to 120C.

[0073] In some embodiments, authenticating the certificate management microservice to the secure storage element includes integrating the certificate management microservice into an external secure vault, such as a secure vault entrusted by an end user of the CNF.

[0074] In some embodiments, authenticating the certificate management microservice to the secure storage element includes: deploying the secure storage element. In some embodiments, deploying the secure storage element includes: establishing a secure vault, for example, by using Hashicorp software.

[0075] In some embodiments, initializing the certificate management microservice includes writing one or more certificates to a secure storage element, for example, by performing some or all of operations 230 discussed below.

[0076] The certificates discussed herein are digital certificates configured according to one or more standards so that they can be used by external entities to prove that the named subject of the certificate has ownership of the public key included in the certificate. In some embodiments, the certificate has a certificate profile based on 3GPP or O-RAN specifications.

[0077] In some embodiments, initializing the certificate management microservice includes: executing a certificate registration procedure. Executing the certificate registration procedure includes: executing one of an initial registration procedure or a re-registration procedure for a given certificate.

[0078] Executing the certificate registration procedure includes: the certificate management microservice communicates with the CA, for example based on: one or more CA identifier parameters included in the configuration parameters 118U, using an authentication registration protocol, for example based on one or more parameters included in the configuration parameters 118U.

[0079] In some embodiments, executing the registration procedure includes executing a procedure corresponding to one of EST, CMP, CMPv2, or SCEP. In some embodiments, executing the registration procedure includes using one or both of libopenssl or libest software.

[0080] In some embodiments, performing the registration procedure includes starting an update timer corresponding to performing the registration procedure for the given certificate.

[0081] In some embodiments, performing the registration procedure includes one or both of sending a registration update request to a certification authority or sending an update notification to a user of the CNF.

[0082] In some embodiments, performing the registration process includes: repeatedly performing the registration procedure for multiple microservices of the CNF.

[0083] At operation 230 , in some embodiments, the credentials are written to a secure storage element.

[0084] In some embodiments, writing the certificate to the secure storage element includes writing a certificate registered by performing some or all of the above operations 220. In some embodiments, writing the certificate to the secure storage element includes writing a default certificate included in or linked to the CNF. In some embodiments, writing the certificate to the secure storage element includes writing a certificate signed by the operator to the secure storage element.

[0085] At operation 240, in some embodiments, a service request is received at a certificate management microservice. Receiving the service request includes receiving a service request corresponding to a key of a certificate associated with the CNF and stored in a secure storage element.

[0086] Receiving a service request includes: receiving a service request from a microservice other than the certificate management microservice of the CNF or from a management system of a network where the CNF is deployed, such as a configuration management system (ConfD), a performance management system (PerfMgr), or an IP security management system (IpsecMgr).

[0087] In some embodiments, receiving the service request at the certificate management microservice includes receiving the service request at the certificate management microservice 122 or CertMgr from the additional microservices 124 or uS-2 to uS-N.

[0088] In some embodiments, receiving the service request at the certificate management microservice includes receiving the service request through an API, for example, using a gRPC message.

[0089] At operation 250, in some embodiments, certificate information is sent from the certificate management microservice to the service requester.Sending certificate information from the certificate management microservice to the service requester includes sending certificate information configured to be usable by the service requester to read a certificate and / or certificate key from a secure storage element.

[0090] In some embodiments, sending certificate information from the certificate management microservice includes sending certificate information from the certificate management microservice 122 or CertMgr to the additional microservice 124 or uS-2 to uS-N.

[0091] At operation 260, in some embodiments, the service requester is used to read the certificate key of the certificate from the secure storage element. In some embodiments, using the service requester includes using the additional microservice 124 or uS-2 to uS-N to read the certificate key from, for example, SecVault.

[0092] At operation 270, in some embodiments, it is detected that the elapsed time is greater than the certificate renewal threshold. Detecting that the elapsed time is greater than the certificate renewal threshold includes, at operation 230, the certificate management microservice detecting that the elapsed time is greater than the certificate renewal threshold based on having started a renewal timer.

[0093] In some embodiments, detecting that the elapsed time is greater than a credential renewal threshold comprises basing the credential renewal threshold on a percentage of a validity period of the credential.

[0094] At operation 280, in some embodiments, a certificate update process is triggered. In some embodiments, triggering the certificate update process includes performing some or all of the operations in operation 230 discussed above.

[0095] In some embodiments, sending a registration update request from the certificate management microservice to the CA includes sending an initial registration update request, and periodically sending subsequent registration update requests from the certificate management microservice to the CA.

[0096] In some embodiments, triggering the certificate update process includes sending an update notification to a user of the CNF. In some embodiments, triggering the certificate update process includes determining a failure of the update process, and based on determining the failure, sending a second registration update request to the CA, and sending a failure notification, such as an alarm, to the user of the CNF.

[0097] In some embodiments, performing operations 270 and 280 includes performing some or all of the following operations:

[0098] When the current system date / time exceeds "Certificate Issue Date" + ("Update Threshold" * "Certificate Validity Period"), the certificate update process will be triggered. At the same time, the device should generate an alarm "Operator Device Certificate Expired in "n" Days". This alarm should be cleared after the certificate is successfully updated.

[0099] For example, if "certificate validity period" = 100 days and "renewal threshold" = 60%, certificate renewal should be triggered when the current system date exceeds "certificate issuance date" + 60 days.

[0100] Certificate renewal can be triggered immediately when the above conditions are met, or at a predefined interval after the above conditions are met, such as at the beginning of the hour after the conditions are met. Since the certificate validity period may be measured in hours, it is useful to ensure that certificate renewal is triggered according to either of the above logic.

[0101] After powering on, if the device realizes that the current system date / time has exceeded "Certificate Issue Date" + ("Update Threshold" * "Certificate Validity Period"), the device will trigger the certificate update process as described above. At the same time, the device should issue an alert "Operator Device Certificate will expire in 'n' days". This alert should be cleared after the certificate is successfully updated.

[0102] After power-on, if the device determines that the certificate has expired, the device will use other credentials to trigger the certificate enrollment process. At the same time, the device should generate an "Operator Device Certificate Expired" alarm. This alarm should clear after successfully enrolling the certificate.

[0103] The VM should use the TLS-SRP credentials provided as part of the Day-0 configuration. The RU / gNB-DU should use the certificate provided by the provider / factory.

[0104] If the renewal procedure fails, the device should periodically retry the certificate renewal at least 10 times during the remaining period (while the certificate is valid). For example: if 40 days are remaining, then the renewal should be attempted at least 10 times during that period (until successful). If 4 days are remaining, the result is the same.

[0105] By executing some or all of the operations of method 200, the system (e.g., system 100) automatically performs some or all of the following operations: receiving a configuration instruction at a certificate management microservice of the CNF, in response to the configuration instruction, initializing the certificate management microservice, wherein initializing the certificate management microservice includes: writing a certificate including a certificate key to a secure storage element, receiving a service request from other microservices of the CNF at the certificate management microservice, and in response to the service request, sending certificate information to the other microservice, wherein the certificate information is configured to be used by the other microservice to read the certificate key from the secure storage element. In some embodiments, the method includes one or more of the following: sending a registration request from the certificate management microservice to the CA, the registration request corresponding to the indicated certificate registration protocol; using the certificate management microservice to detect an elapsed time greater than an update threshold of the certificate; and in response to detecting that the elapsed time is greater than the update threshold, sending a registration update request from the certificate management microservice to the CA, and in some embodiments, including sending an initial registration update request and periodically sending subsequent registration update requests from the certificate management microservice to the CA.

[0106] By performing some or all of the method operations, the microservice level certificate manager can be easily encapsulated in RAN CNF, such as CUCP, CUUP, 5G DU, and non-RAN CNF, such as Kafka, EMS, FCAPS services, which require operator certificates, can be easily extended to support any new registration and re-registration protocols, provide gRPC and JSONAPI based interfaces for communicating with other microservices in CNF, can communicate with RA and CA for registration and re-registration controlled for different customer needs, and can support default certificates that can be used for customer lab testing and POC, for example, based on the absence of CA. Thus, the certificate management microservice supports multiple registration and re-registration protocols, such as algorithms that can be selected when instantiating CNF based on customer needs, re-registration of certificates within a configurable window before expiration, notification of changes to device certificates and keys to applications, authentication based on provider certificates and TLS-SRP equivalent methods for registration, single or multiple certificates for applications, use of secure vaults to store keys, changing certificate profiles corresponding to 3GPP and O-RAN specifications, and operator-specified alerts during registration or re-registration failures. Compared to other approaches, such as namespace-level or cluster-level certificate management provided by Kubernetes (K8s), digital certificates can be more widely and efficiently managed automatically in cloud-native networking applications, such as RAN and open RAN applications.

[0107] Figure 3 is a flow chart of a certificate management method 300 according to some embodiments. The certificate management method 300, also referred to as method 300 or method of operating CNF 300 in some embodiments, is a non-limiting example of some or all of the above method 200.

[0108] Method 300 and Figure 3 Operations 210 to 250 correspond to each other. Figure 3 In the illustrated embodiment, operation 230 of method 200 corresponds to separate operations 230A and 230B of method 300 based on whether registration is required. If not required, at operation 230A, writing the certificate to the secure storage element includes writing one or more default certificates to the secure storage element. If required, at operation 230B, writing the certificate to the secure storage element includes: writing one or more registered certificates to the secure storage element after performing the registration and / or re-registration process.

[0109] By performing some or all of the operations of method 200 according to the non-limiting example of method 300, the above-mentioned Figures 1A to 2 The benefits discussed.

[0110] Figure 4 is a flow chart of a certificate management method 400 according to some embodiments. The certificate management method 400, in some embodiments, also referred to as method 400 or method of operating CNF 400, is a non-limiting example of some or all of the above method 200.

[0111] Method 400 and Figure 4 Operations 220 to 250 are shown to correspond.

[0112] By performing some or all of the operations of method 200 according to the non-limiting example of method 400, the above-mentioned Figures 1A to 2 The benefits discussed.

[0113] Figure 5 is a flow chart of a certificate management method 500 according to some embodiments. The certificate management method 500, also referred to in some embodiments as method 500 or method of operating CNF 500, is a non-limiting example of some or all of the method 200 discussed above.

[0114] Method 500 and Figure 5 Operations 240 to 280 are shown to correspond.

[0115] By performing some or all of the operations of method 200 according to the non-limiting example of method 500, the above-mentioned Figures 1A to 2 The benefits discussed.

[0116] In some embodiments, a method of operating a CNF includes: receiving a configuration instruction at a certificate management microservice of the CNF; in response to the configuration instruction, initializing the certificate management microservice, wherein initializing the certificate management microservice includes writing a certificate including a certificate key to a secure storage element; receiving a service request from other microservices of the CNF at the certificate management microservice; and in response to the service request, sending certificate information to the other microservices, wherein the certificate information is configured to be used to read the certificate key from the secure storage element by the other microservices. In some embodiments, initializing the certificate management microservice includes: integrating the certificate management microservice into a secure storage element including a secure vault or a persistent volume. In some embodiments, initializing the certificate management microservice also includes: setting a certificate registration protocol. In some embodiments, initializing the certificate management microservice includes: instantiating a certificate manager based on a parameter set including an authentication parameter. In some embodiments, initializing the certificate management microservice includes: performing a registration procedure for a certificate with a certification authority based on the parameter set, and starting an update timer corresponding to performing the registration procedure for the certificate. In some embodiments, the described method includes: detecting that an elapsed time of the update timer exceeds an update threshold; and in response to detecting that the elapsed time exceeds the update threshold, sending a registration update request to the certification authority, and sending an update notification to a user of the CNF. In some embodiments, the method includes: based on the failure of the registration update request, sending a second registration update request to the certification authority, and sending a failure notification to the user of the CNF. In some embodiments, writing the certificate including the certificate key to the secure storage element includes: writing the certificate signed by the operator to the secure storage element. In some embodiments, writing the certificate including the certificate key to the secure storage element includes: writing the default certificate to the secure storage element. In some embodiments, the CNF includes a CNF in a CU CNF or a DU CNF of a radio access network RAN.

[0117] In some embodiments, a method for managing digital certificates in a cloud network includes: sending a service request from an active microservice of a CNF of the cloud network to a certificate management microservice of the CNF, sending certificate information from the certificate management microservice to the active microservice in response to receiving the service request, and reading a certificate key from a secure storage element using the active microservice based on the certificate information. In some embodiments, the method includes: pushing a configuration message to the certificate management microservice, and in response to receiving the configuration message, instantiating a certificate management microservice including a certificate (including a certificate key) to a secure storage element. In some embodiments, pushing the configuration message to the certificate management microservice includes: pushing a configuration message including a configuration parameter set, the configuration parameter set including: one or more identifiers corresponding to a certification authority CA and a certificate enrollment protocol. In some embodiments, the method includes: sending a registration request from the certificate management microservice to the CA based on the one or more identifiers, wherein the registration request corresponds to the certificate enrollment protocol. In some embodiments, the method includes: using the certificate management microservice to detect an elapsed time greater than an update threshold of the certificate, and in response to detecting that the elapsed time is greater than the update threshold, sending a registration update request from the certificate management microservice to the CA. In some embodiments, sending a registration update request from a certificate management microservice to a CA includes sending an initial registration update request, and the method includes periodically sending subsequent registration update requests from the certificate management microservice to the CA. In some embodiments, reading a certificate key using an active microservice includes reading a certificate key corresponding to a certificate profile based on a 3GPP or O-RAN specification. In some embodiments, the active microservice is a first active microservice among a plurality of active microservices of a CNF, and the method includes sending additional certificate information from the certificate management microservice to a second active microservice among the plurality of active microservices, and based on the additional certificate information, reading another certificate key from a secure storage element using the second active microservice. In some embodiments, the cloud network includes an O-RAN.

[0118] In some embodiments, a computer-readable medium includes instructions executable by a controller of a network device (e.g., a VNF) to cause the controller to perform operations, including: receiving configuration instructions at a certificate management microservice of the CNF, and instantiating the certificate management microservice in response to the configuration instructions, wherein instantiating the certificate management microservice includes: writing a certificate including a certificate key to a secure storage element, receiving a service request from other microservices of the CNF at the certificate management microservice, and sending certificate information to the other microservices in response to the service request, wherein the certificate information is configured to be used by the other microservices to read the certificate key from the secure storage element.

[0119] The foregoing summarizes the features of several embodiments so that those skilled in the art can better understand the various aspects of the present disclosure. Those skilled in the art understand that they can easily use the present disclosure as a basis for designing or modifying other processes and structures to achieve the same purpose of the embodiments introduced herein and / or to achieve the same advantages of the embodiments introduced herein. Those skilled in the art also recognize that such equivalent constructions do not depart from the spirit and scope of the present disclosure, and that they make various changes, substitutions and modifications herein without departing from the spirit and scope of the present disclosure.

Claims

1. A method of operating a cloud native network function (CNF), the method comprising: Receiving configuration instructions at a certificate management microservice of the CNF; In response to the configuration instruction, initializing the certificate management microservice, wherein the initializing the certificate management microservice includes: writing a certificate including a certificate key into a secure storage element; Receiving, at the certificate management microservice, service requests from other microservices of the CNF; and In response to the service request, certificate information is sent to the other microservice, wherein the certificate information is configured to be usable by the other microservice to read the certificate key from the secure storage element.

2. The method according to claim 1, wherein the initializing the certificate management microservice further comprises: Integrate the credential management microservice into the secure storage element including a secure vault or persistent volume.

3. The method according to claim 1, wherein the initializing the certificate management microservice further comprises: Set the certificate enrollment protocol.

4. The method according to claim 1, wherein the initializing the certificate management microservice further comprises: The credential manager is instantiated based on a parameter set including authentication parameters.

5. The method according to claim 4, wherein the initializing the certificate management microservice further comprises: Based on the parameter set, performing a registration procedure for the certificate with a certification authority; as well as An update timer corresponding to performing the registration procedure for the certificate is started.

6. The method according to claim 5, further comprising: detecting that the elapsed time of the update timer exceeds an update threshold; as well as In response to the detecting that the elapsed time exceeds the update threshold: sending a registration update request to the certification authority; and An update notification is sent to users of the CNF.

7. The method of claim 6, further comprising, based on the failure of the registration update request: sending a second registration update request to the certification authority; and A failure notification is sent to the user of the CNF.

8. The method of claim 1 , wherein writing the certificate including the certificate key to the secure storage element comprises: The operator-signed certificate is written to the secure storage element.

9. The method of claim 1 , wherein writing the certificate including the certificate key to the secure storage element comprises: Default credentials are written to the secure storage element.

10. The method of claim 1, wherein the CNF comprises one of a centralized unit (CU) CNF or a distributed unit (DU) CNF of a radio access network (RAN).

11. A method for managing digital certificates in a cloud network, the method comprising: Sending a service request from an activity microservice of a cloud native network function (CNF) of a cloud network to a certificate management microservice of the CNF; In response to receiving the service request, sending certificate information from the certificate management microservice to the activity microservice; as well as Based on the certificate information, a certificate key is read from a secure storage element using the activity microservice.

12. The method according to claim 11, further comprising: Push configuration message to the certificate management microservice; as well as In response to receiving the configuration message, the certificate management microservice is instantiated, wherein the instantiating the authentication management microservice includes: writing a certificate including the certificate key into the secure storage element.

13. The method according to claim 12, wherein pushing the configuration message to the certificate management microservice comprises: Push the configuration message including a configuration parameter set, wherein the configuration parameters include: one or more identifiers corresponding to a certification authority (CA); and Certificate Enrollment Agreement.

14. The method according to claim 13, further comprising: Based on the one or more identifiers, sending a registration request from the certificate management microservice to the CA, The registration request corresponds to the certificate registration protocol.

15. The method according to claim 14, further comprising: Detecting, using the certificate management microservice, an elapsed time greater than a renewal threshold for the certificate; as well as In response to detecting that the elapsed time is greater than the update threshold, sending a registration update request from the certificate management microservice to the CA.

16. The method according to claim 15, wherein Sending the registration update request from the certificate management microservice to the CA includes: Send the initial registration update request, and The method also includes periodically sending subsequent registration update requests from the certificate management microservice to the CA.

17. The method of claim 11, wherein the using the activity microservice to read the certificate key comprises: The certificate key corresponding to the certificate profile is read based on 3GPP or Open Radio Access Network (O-RAN) specifications.

18. The method according to claim 11, wherein The active microservice is a first active microservice among a plurality of active microservices of the CNF, and The method further comprises: Sending additional certificate information from the certificate management microservice to a second active microservice among the plurality of active microservices; as well as Based on the additional credential information, another credential key is read from the secure storage element using the second active microservice.

19. The method of claim 11, wherein the cloud network comprises an open radio access network (O-RAN).

20. A computer-readable medium comprising instructions executable by a controller of a network device to cause the controller to perform operations comprising: receiving configuration instructions at a certificate management microservice of a cloud native network function (CNF); In response to the configuration instruction, instantiating the certificate management microservice, wherein the instantiating the authentication management microservice includes: writing a certificate including a certificate key to the secure storage element; Receiving, at the certificate management microservice, service requests from other microservices of the CNF; and In response to the service request, certificate information is sent to the other microservice, wherein the certificate information is configured to be usable by the other microservice to read the certificate key from the secure storage element.

Images