Network slice or tenant specific automatic certificate management configuration

Abstract

Example embodiments of the present disclosure relate to devices, methods, apparatuses, and computer-readable media that support network slicing or tenant-specific automated certificate management configurations. The network slice credential orchestrator may be configured to: receive, from a management system, a certification authority configuration indicating a certification authority configured for one or more network slices; and transmitting a certificate request regarding a network function assigned to one of the one or more network slices, and information of the certificate authentication authority configured for the one or more network slice configurations, to a registration authority or an authentication authority.

Description

Technical Field

[0001] Various exemplary embodiments described herein relate generally to communication technology, and more specifically, to devices, methods, apparatuses, and computer-readable media that support network slicing or tenant-specific automatic certificate management configuration. Background Art

[0002] 5G New Radio (NR) is designed for various use cases including, for example, enhanced mobile broadband (eMBB), massive machine type communication (mMTC), and ultra-reliable low latency communication (uRLLC). The use cases may require different types of functions and networks in terms of mobility, security, policy control, latency, coverage, and reliability. Therefore, network slicing is proposed to slice one physical network into multiple virtual end-to-end (E2E) networks to carry different types of communication services with different characteristics and requirements. Summary of the invention

[0003] In general, the example embodiments of the present disclosure provide a solution for network slice or tenant specific automatic certificate management configuration.

[0004] In a first aspect, an example embodiment of a network slice certificate orchestrator is provided. The network slice certificate orchestrator may include at least one processor and at least one memory storing instructions. When executed by the at least one processor, the instructions cause the network slice certificate orchestrator to at least: receive a certificate authority configuration indicating a certificate authority configured for one or more network slices from a management system, and transmit a certificate request for a network function assigned to one of the one or more network slices and information of the certificate authority configured for the one or more network slices to a registration authority or a certificate authority.

[0005] In a second aspect, an example embodiment of a management system is provided. The management system may include at least one processor and at least one memory storing instructions. When executed by the at least one processor, the instructions cause the management system to at least: establish a secure connection with a network slice certificate orchestrator, and transmit to the network slice certificate orchestrator a certificate authority configuration indicating a certificate authority configured for one or more network slices.

[0006] Example embodiments of methods, apparatus, and computer-readable media are also provided. Such example embodiments generally correspond to the above-described example embodiments of the device, and for convenience, a repeated description thereof is omitted here.

[0007] Other features and advantages of example embodiments of the present disclosure will be apparent from the following description of specific embodiments when read in conjunction with the accompanying drawings, which illustrate, by way of example, the principles of example embodiments of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Some example embodiments will now be described, by way of non-limiting examples, with reference to the accompanying drawings.

[0009] Figure 1 It is a schematic block diagram showing network slices that are logically isolated from each other based on tenants.

[0010] Figure 2 is a schematic message flow diagram illustrating a process according to an example embodiment of the present disclosure.

[0011] Figure 3 is a schematic block diagram illustrating a tenant-specific root certification authority configuration for a network slice belonging to a tenant according to an example embodiment of the present disclosure.

[0012] Figure 4 is a schematic block diagram illustrating a network slice specific root certification authority configuration according to an example embodiment of the present disclosure.

[0013] Figure 5 is a schematic block diagram illustrating a tenant-specific sub-certification authority configuration for a network slice belonging to a tenant according to an example embodiment of the present disclosure.

[0014] Figure 6 is a schematic block diagram illustrating a network slice specific sub-certification authority configuration according to an example embodiment of the present disclosure.

[0015] Figure 7 is a schematic block diagram illustrating a device according to an example embodiment of the present disclosure.

[0016] Figure 8 is a schematic block diagram illustrating a device according to an example embodiment of the present disclosure.

[0017] Fig. 9 is a schematic block diagram illustrating an apparatus according to an example embodiment of the present disclosure.

[0018] Fig.10 is a schematic block diagram illustrating an apparatus according to an example embodiment of the present disclosure.

[0019] Throughout the drawings, the same or similar reference numerals denote the same or similar elements, and repeated description of the same elements will be omitted. Summary of the invention

[0021] Below, some example embodiments are described in detail with reference to the accompanying drawings. The following description includes specific details for the purpose of providing a thorough understanding of the various concepts. However, it is apparent to those skilled in the art that these concepts can be practiced without these specific details. In some cases, well-known circuits, techniques, and components are shown in block diagram form to avoid obscuring the concepts and features described.

[0022] Network slicing is a capability that enables many vertical users to create and manage logically separated resources dedicated to their own applications across, for example, the 5G System (5GS), while ensuring that the required service level requirements are always met. A network slice can be understood as a logical network running on top of a physical network, and multiple network slices running on a physical network can share network resources. For example, when a sensitive service runs on a network slice that needs to be isolated from other services, the network slice can be logically isolated from other slices.

[0023] Figure 1 A scenario is shown where network slices are logically isolated based on tenants. Figure 1 , the first tenant 101a has a first slice (slice #1) providing uRLLC service, the second tenant 101b has a second slice (slice #2) providing eMBB service, and the third tenant 101c has a third slice (slice #3) providing uRLLC service and a fourth slice (slice #4) providing eMBB service. Network slices #1 to #4 may be hosted in the data center of the same operator. In a tenant-based isolation scenario, such as Figure 1 As shown by the dotted box in the figure, the network slice #1 owned by the first tenant 101a, the network slice #2 owned by the second tenant 101b, and the network slices #3 and #4 owned by the third tenant 101c are logically isolated. Since the network slices span the access network (AN), the transport network (TN), and the core network (CN), slice isolation is also ensured in each of the AN domain, the TN domain, and the CN domain.

[0024] It should be understood that network slices may also be isolated in other ways. For example, network slices may be isolated based on slice service type (SST). Figure 1 , network slices #1 and #3 providing uRLLC services can be isolated from network slices #2 and #4 providing eMBB services.

[0025] Digital certificates are used to establish authenticated and encrypted connections between various network functions (NFs), and the lifecycle of digital certificates needs to be carefully managed. For example, digital certificates may need to be renewed and updated for various reasons. To ensure good management of digital certificates, automatic certificate management can be implemented. Different network slices and tenants may have different requirements for automatic certificate management, and different certification authorities (CAs) may be used for different tenants and / or different network slices. It is expected that automatic certificate management can be flexibly configured for slices and tenants. Network operators may also want to provide flexible business models in terms of slice or tenant specific automatic certificate management.

[0026] On the other hand, if there is a potential loop-hole in the implementation of automatic certificate management, it may lead to security risks and adversely affect the services provided to vertical users. For example, if the automatic certificate renewal is not completed before the expiration date, it may cause slice / service unavailability, which requires manual management of certificates. Vertical users of network slices hosted in the same operator's data center may want to obtain automatic certificate management that ensures that any damage / failure of the operator will not affect the security of their own business. Vertical users may also want to use their trusted CA for all or part of the slice-specific services.

[0027] However, the current 3GPP specifications do not support flexible automatic certificate management configuration. Vertical users are not allowed to use slice-specific or tenant-specific automatic certificate management services to protect their services. Vertical users must rely on the automatic certificate management services provided by operators, including operator CA, operator automation, etc. This also brings additional costs to vertical users.

[0028] According to aspects of the present disclosure, a mechanism for flexible automatic certificate management configuration is proposed. In some example embodiments, a network slice certificate orchestrator (NSCO) may provide an interface to an authorized third party, which may own one or more network slices, to allow flexible configuration of automatic certificate management services. The third party may configure its own root CA or subordinate CA to manage certificates used by network functions assigned to a specific slice owned by the third party.

[0029] Figure 2 A process for automatic certificate management configuration according to an example embodiment of the present disclosure is shown. Figure 2 , operator 102, network slice orchestrator (NSO) 104, management system 106, network slice certificate orchestrator (NSCO) 108, registration authority (RA) 110, certification authority (CA) 112, and network function (NF) 114 are shown as example entities involved in the process. It should be understood that the operations performed by operator 102 can be performed by operator 102 using related network functions, such as network slice management function (NSMF).

[0030] like Figure 2As shown in , at 210, the operator 102 may coordinate with the network slice orchestrator 104 to create and initialize a new network slice for a third-party vertical user (i.e., a tenant). The operator 102 may create a network slice based on a service level agreement (SLA) or a service profile that specifies requirements such as bandwidth, rate, latency, connectivity, etc. for services to be run on the network slice. The network slice orchestrator 104 may be responsible for network function initialization and registration, logical resource allocation across the core network (CN) domain, the transport network (TN) domain, and the access network (AN) domain. Although not shown, additional logical functions such as network slice instance (NSS) management functions, network slice resource module functions, NSS inventory functions, network slice data collection and analysis functions, etc. may also be used when creating and initializing a new network slice. In one example, the network slice orchestrator 104 and one or more of the additional logical functions may be included as part of a network slice management function (NSMF), and the operator 102 may operate the NSMF to create and initialize network slices for tenants. The created network slice may have a single network slice selection assistance information (S-NSSAI) that uniquely identifies the network slice.

[0031] At 212, the management system 106 may establish a secure connection with the network slice certificate orchestrator (NSCO) 108 to exchange certification authority (CA) configuration related information. For example, the management system 106 may establish a mutual transport layer security (mTLS) connection with the NSCO 108. The management system 106 may be a third-party management system, such as a certificate management server owned or commissioned by a tenant authorized by the operator 102, and the NSCO 108 provides an interface toward the certificate management server. The operator 102 allows the tenant to use a third-party certificate management server to configure his own automatic certificate management service. In another example, the management system 106 may be provided by the operator 102 to support flexible automatic certificate management configuration. For example, the management system 106 may be implemented as part of an operations management and maintenance (OAM) entity.

[0032] At 214, the management system 106 may transmit a CA configuration (i.e., an automatic certificate management configuration) to the NSCO 108. The management system 106 may utilize the CA configuration to configure a root CA or a subordinate CA (sub-CA) to manage certificates in one or more network slices. In one example, the details of the CA configuration may include one or more of the following:

[0033] A list of one or more network slices to which the CA configuration applies;

[0034] The Internet Protocol (IP) address or Uniform Resource Locator (URL) of the CA configured for one or more network slices;

[0035] Information about a Domain Name System (DNS) server that is configured to resolve the CA's URL; or

[0036] Purpose of CA.

[0037] The list of one or more network slices may include, for example, the S-NSSAI of the one or more network slices. In another example, the list of one or more network slices may be represented by an identifier of the tenant, which means that the configured CA applies to all network slices owned by the tenant. The information of the DNS server may include, for example, the IP address of the DNS server. The purpose of the CA may indicate whether the configured CA is used as a root CA or a subordinate CA (sub-CA) for certificates in one or more network slices. In one example, if the configured CA is a subordinate CA, the usage field may provide information of a hierarchical CA structure including a subordinate CA and one or more higher-level CAs.

[0038] Figure 3-6 Some example scenarios of CA configuration are shown. By way of example, Figure 3-6 It is shown that a first tenant 101a has a first network slice (slice #1), a second tenant 101b has a second network slice (slice #2), and a third tenant 101c has third and fourth network slices (slices #3, #4). Network slices #1 to #4 each have one or more end entity (EE) certificates installed on end entities, such as network functions assigned to the respective network slices. In an example scenario, by using the CA configuration transmitted to the NSCO 108 at 214, one or more network slices owned by the third tenant 101c can be flexibly configured with a root CA or a subordinate CA (sub-CA) for automatic certificate management.

[0039] First reference Figure 3 , shows the tenant-specific root CA 305a configured for the third tenant 101c, i.e., the root CA 305a configured for the network slices #3 and #4 owned by the third tenant 101c. The root CA 305a will then be used to sign and manage the certificates used by the network functions assigned to the network slices #3 and #4 belonging to the third tenant 101c. The root CA 305a can publish a certificate revocation list (CRL) or run an online certificate status protocol (OCSP) service for end-entity (EE) certificate validity checking. The end entity can also check the validity of the root / sub-CA certificate with the CRL or OCSP service.

[0040] In an example embodiment, the root CA 305a may be owned by the third tenant 101c. The third tenant 101c may configure his own automatic certificate management service for the network slice owned by the third tenant 101c. Other network slices belonging to other tenants (i.e. Figure 3In the example shown in FIG. 1 , the first tenant 101a and the second tenant 101b) can use the operator's CA for automatic certificate management. Figure 3 An intermediate CA 303 is shown under the root CA 301, both of which can be provided by the operator for automatic certificate management of certificates in slice #1 and slice #2. The intermediate CA, sometimes also called a subordinate CA, is located between the root CA and the end-entity certificate, and its main purpose is to define and authorize the types of certificates that can be requested from the root CA. For example, different intermediate CAs can be provided for different locations or different certificate types. In the CA hierarchy, there can be more than one level of intermediate CAs between the root CA and the end-entity certificate, and the CA hierarchy creates a chain of trust that the end-entity certificate relies on. Each end entity is signed by the intermediate CA above it, and the intermediate CA is signed by a higher-level intermediate CA or root CA. The root CA is at the highest level of the CA hierarchy and acts as a trust anchor for signing all intermediate CAs immediately below it. Figure 3 An intermediate CA 303 is shown between the root CA 301 and the end-entity certificate. Similar to the root CA 305a, the intermediate CA 303 and the root CA 301 can each publish a CRL or run an OCSP service for certificate validity checking.

[0041] In another example embodiment, the root CA 301, the intermediate CA 303, and the root CA 305a may all be provided by a network operator. For example, the root CA 305a is provided for a network slice of a specific tenant, while the intermediate CA 303 and the root CA 301 are provided for other tenants. In this regard, the root CA 305a may be referred to as a dedicated CA, and the intermediate CA 303 and the root CA 301 may be referred to as public CAs. The operator may provide flexible CA configuration and automatic certificate management services for specific tenants.

[0042] Figure 4 A slice-specific root CA configuration scenario is shown, in which the root CA 305b is configured for the fourth slice #4 of the third tenant 101c. Another slice #3 of the third tenant 101c, the network slice #1 of the first tenant 101a, and the network slice #2 of the second tenant 101b can use the intermediate CA 303 under the root CA 301. In one example, the root CA 305b can be owned by the third tenant 101c. The third tenant 101c can configure his own automatic certificate management service for a certain network slice owned by the third tenant 101c, while other network slices owned by the third tenant 1011c can still use the automatic certificate management service provided by the operator. In another example, the root CA 301, the intermediate CA 303, and the root CA 305b can all be provided by the operator. The operator can provide flexible CA configuration and automatic certificate management services for specific network slices. Figure 4 Other aspects of the scene shown in Figure 3 The scenes shown in are similar, and for convenience, repeated descriptions are omitted here.

[0043] Figure 5 A tenant-specific subordinate CA (sub-CA) configuration scenario is shown, where a sub-CA 305c is configured for all network slices owned by the third tenant 101c (i.e., the third slice #3 and the fourth slice #4). The sub-CA 305c may be signed by another intermediate or root CA. Figure 5 In the example shown, sub-CA 305b is signed by intermediate CA 303, and intermediate CA 303 is signed by root CA 301. In one example, sub-CA 305c may be owned by a third tenant 101c. Automatic certificate management, including expiration and revocation processing, for sub-CA 305c and network slices owned by the third tenant 101c may be configured by the third tenant 101c. Alternatively, sub-CA 305c may be managed by an authorization management or intelligent function provided by an operator based on a service level agreement (SLA) signed between the operator and the third tenant 101c. In another example embodiment, sub-CA 305c, intermediate CA 303, and root CA 301 may all be provided by an operator. The operator may provide flexible CA configuration and automatic certificate management services for specific tenants. Figure 5 Other aspects of the scene shown in Figure 3 The scenes shown in are similar, and for convenience, repeated descriptions are omitted here.

[0044] Figure 6 A slice-specific subordinate CA (sub-CA) configuration scenario is shown, where sub-CA 305d is configured for the fourth slice #4 of the third tenant 101c. Figure 5 Similar to the tenant-specific sub-CA 305c in , the slice-specific sub-CA 305d may also be signed by the intermediate CA 303. In one example, the sub-CA 305d may be owned by the third tenant 101c. Automatic certificate management including expiration and revocation processing for the sub-CA 305d and network slice #4 may be configured by the third tenant 101c. Alternatively, the sub-CA 305d may be managed by the authorization management or intelligent functions provided by the operator based on the service level agreement (SLA) signed between the operator and the third tenant 101c. In another example embodiment, the sub-CA 305d, the intermediate CA 303 and the root CA 301 may all be provided by the operator. The operator can provide flexible CA configuration and automatic certificate management services for specific network slices. Figure 6 Other aspects of the scene shown in Figure 5 The scenes shown in are similar, and for convenience, repeated descriptions are omitted here.

[0045] Return to reference Figure 2At 214, using the CA configuration transmitted from the management system 106 to the NSCO 108, the management system 106 can configure a root CA or a sub-CA for a specific network slice or a specific tenant. Then, the configured root CA or sub-CA can provide automatic certificate management services to the specific network slice or the specific tenant (i.e., all network slices owned by the tenant), including, for example, certificate signing, revocation, renewal, update, etc. In the following, the new certificate signing process will be discussed as an example.

[0046] At 216, the network slice orchestrator 104 may transmit a network function (NF) certificate request to the NSCO 108. In an example embodiment, the NF certificate request may also be transmitted to the NSCO 108 from other management systems such as a network slice management function (NSMF) or an operation management and maintenance (OAM) entity. The request may include identity information of the NF, identity information of the network slice to which the NF belongs, and a public key of the NF to be signed. The identity information of the NF may include, for example, an IP address, URL, or identifier of the NF, and the identity information of the network slice may include, for example, single network slice selection assistance information (S-NSSAI) of the network slice. In one example, the request may also include information such as a key type and length of the public key to be signed.

[0047] In response to the NF certificate request, the NSCO 108 may determine a certification authority (CA) for the network slice including the NF according to the S-NSSAI included in the NF certificate request, and send the NF certificate request together with the information of the determined CA to the registration authority (RA) 110 at 218. It is assumed here that trust is pre-established between the NSCO 108 and the RA 110. The information of the CA may include, for example, an IP address or URL of the CA. In one example, the information of the CA may also include information of a DNS server for resolving the URL of the CA.

[0048] At 220, RA 110 may forward the NF certificate request to the CA 112 indicated in the received CA information. RA 110 may have a pre-established trust with CA 112, and based on the CA information, RA 110 may transmit the NF certificate request to the appropriate CA 112. In an example embodiment, before RA 110 forwards the NF certificate request to CA 112, RA 110 may check whether NSCO 108 has the right to request a certificate for the network function. In an example embodiment, RA 110 may be integrated in CA 112, and it is generally referred to as CA / RA. NSCO 108 may then transmit the NF certificate request to CA 112. CA 112 receives the NF certificate request and signs the public key of the network function, thereby generating a signed digital certificate for the network function.

[0049] At 222, CA 112 may respond to RA 110 with a signed certificate for the network function. If CA 112 is a root CA, a certificate signed by root CA 112 is sufficient. If CA 112 is a sub-CA, in addition to the NF certificate signed by sub-CA 112, sub-CA 112 may also transmit to RA 110 a chain of trust from sub-CA 112 to the root CA associated with sub-CA 112. The chain of trust may include the certificate chain of sub-CA 112 and one or more higher-level intermediate CAs, if any. Each certificate in the chain of trust is signed by an associated higher-level CA, and the final highest-level certificate is signed by the root CA associated with sub-CA 112. For example, in Figure 5 or Figure 6 In the scenario shown, sub-CA 305d is a network function signing certificate, and sub-CA 305d will transmit to RA 110 the certificate of sub-CA 305 signed by intermediate CA 303 and the certificate of intermediate CA 303 signed by root CA 301, as well as the NF certificate signed by sub-CA 305.

[0050] At 224, NSCO 108 may receive a certificate for the NF signed by CA 112 from RA 110. If CA 112 is a root CA, NSCO 108 may also receive from RA 110 a trust chain from the child CA 112 to the root CA associated with the child CA 112.

[0051] In the example embodiment described above where RA 110 is integrated in CA 112 and NSCO 108 transmits a NF certificate request to CA 112 , NSCO 108 may transmit a signed certificate for the NF and a trust chain from CA 112 .

[0052] NSCO 108 may then send the certificate for the NF signed by CA 112, and the trust chain (if any), to the corresponding NF 114. In one example, at 226a, NSCO 108 may transmit the signed NF certificate to NSO 104 or other management system, such as NSMF or OAM entity, and then at 228, NSO 104 or other management system may send the signed NF certificate to NF 114. In another example, at 226b, NSCO 108 may send the signed NF certificate directly to NF 114. NSCO 108 may also send a copy of the signed NF certificate to NSO 104, but NSO 104 is not required to forward the signed NF certificate to NF 114.

[0053] References in the above Figure 2-6In the example embodiments discussed, flexible CA and automatic certificate management services can be configured for a specific network slice or a specific tenant. An interface is provided to the management system owned by the operator or a third party through the Network Slice Certificate Orchestrator (NSCO), allowing the management system to configure the root CA or subordinate CA for a specific slice or a specific tenant. It enables the operator or third party that owns the management system to configure flexible CA and automatic certificate management services for a specific slice.

[0054] Figure 7 4 is a schematic block diagram illustrating an apparatus 400 according to an example embodiment of the present disclosure. The apparatus 400 may be implemented to include or form at least a portion of a network slice certificate orchestrator (NSCO) such as the NSCO 108 discussed above to perform operations related to the NSCO 108. Figure 1-6 The operations associated with NSCO 108 are discussed in detail, so the blocks of device 400 will be briefly described here, and the details thereof may be referred to the above description.

[0055] refer to Figure 7 , the device 400 may include: a first device 410, for receiving a certification authority configuration indicating a certification authority configured for one or more network slices from a management system such as a certificate management server owned by a third party or an OAM entity owned by an operator; a second device 420, for transmitting a certificate request regarding a network function assigned to one of the one or more network slices, and information of a certificate certification authority configured for one or more network slices to a registration authority or a certification authority.

[0056] In an example embodiment, the certificate authority configuration may include at least one of: a list of one or more network slices, an Internet Protocol address or uniform resource locator of a certificate authority configured for one or more network slices, information of a domain name system server configured to resolve the uniform resource locator of the certificate authority, or a purpose of the certificate authority. For example, the purpose of the certificate authority may indicate whether the certificate authority is a root certificate authority or a subordinate certificate authority for one or more network slices.

[0057] In an example embodiment, the apparatus 400 may further include a third means 430 for receiving a certificate request for a network function from a network slice orchestrator or other management system such as a network slice management function or an operations management and maintenance entity. The second means 420 may then transmit the certificate request to a registration authority.

[0058] In an example embodiment, the certificate authority information transmitted to the registration authority may include at least one of an Internet Protocol address or a uniform resource locator of the certificate authority, or information of a domain name system server configured to resolve the uniform resource locator of the certificate authority.

[0059] In an example embodiment, the device 400 may also include: a fourth device 440 for receiving a certificate of the network function signed by a certification authority configured for one or more network slices from a registration authority or a certification authority; and a fifth device 450 for sending the signed certificate to the network function.

[0060] In an example embodiment, the certification authority is a subordinate certification authority configured for one or more network slices, and in addition to the network function certificate signed by the subordinate certification authority, the fourth device 440 also receives from the registration authority or the subordinate certification authority a trust chain from the subordinate certification authority to a root certification authority associated with the subordinate certification authority. The trust chain may include a certificate chain ultimately signed by the root certification authority. The fifth device 450 may transmit the trust chain to the network function together with the certificate of the network function signed by the subordinate certification authority.

[0061] In an example embodiment, the fifth means 450 may include: a first sub-means 452 for sending the signed certificate directly to the network function; or a second sub-means 454 for sending the signed certificate to a network slice orchestrator or other management system such as a network slice management function or an operations management and maintenance entity. The network slice orchestrator or other management system may then forward the signed certificate to the network function.

[0062] It should be understood that the apparatus 400 may also include additional means for performing operations associated with the NSCO 108 as described above.

[0063] Figure 8 5 is a schematic block diagram illustrating an apparatus 500 according to an example embodiment of the present disclosure. The apparatus 500 may be implemented to include or form at least a portion of a management system similar to the management system 106 described above to perform operations associated with the management system 106. Figure 1-6 The operations associated with the management system 106 are discussed in detail, so the blocks of the device 500 will be briefly described here, and the details thereof may be referred to the above description.

[0064] refer to Figure 8 , the device 500 may include: a first device 510 for establishing a secure connection with a network slice certificate orchestrator; and a second device 520 for transmitting to the network slice certificate orchestrator a certification authority configuration indicating a certification authority configured for one or more network slices.

[0065] In an example embodiment, the certification authority configuration may include at least one of: a list of one or more network slices, an Internet Protocol address or uniform resource locator of a certification authority configured for the one or more network slices, information of a domain name system server configured to resolve the uniform resource locator of the certification authority, or a purpose of the certification authority. For example, the purpose of the certification authority may indicate whether the certification authority is a root certification authority or a subordinate certification authority for the one or more network slices.

[0066] It should be understood that the device 500 may also include additional devices for performing operations associated with the management system 106 described above.

[0067] In an example embodiment, Figure 7-8 The apparatus shown in the may include circuits configured to perform the relevant operations. The term "circuitry" may refer to one or more or all of the following:

[0068] (a) hardware circuit implementations only (such as implementations in analog and / or digital circuits only) and

[0069] (b) a combination of hardware circuitry and software, such as (where applicable):

[0070] (i) a combination of analog and / or digital hardware circuitry and software / firmware, and

[0071] (ii) any portion of a hardware processor and software (including a digital signal processor), software and memory that work together to enable a device (such as a mobile phone or server) to perform various functions, and

[0072] (c) Hardware circuits and / or processors, such as a microprocessor or portion of a microprocessor, that require software (e.g., firmware) to operate, but where the software may not be present, the software may not be required for operation.

[0073] The above definition of circuitry applies to all uses of the term in this application, including in any claims. As a further example, as used in this application, the term circuitry also covers implementations of only a hardware circuit or processor (or multiple processors) or a portion of a hardware circuit or processor and its (or their) accompanying software and / or firmware. The term circuitry also covers, for example and if applicable to a particular claim element, a baseband integrated circuit or processor integrated circuit for a mobile device or a similar integrated circuit in a server, cellular network device, or other computing or network device.

[0074] Fig. 9 is a schematic block diagram showing an apparatus 600 according to an exemplary embodiment of the present disclosure. The apparatus 600 may be implemented as the network slice certificate orchestrator 108 described above.

[0075] refer to Fig. 9 , the device 600 may include one or more processors 610 and one or more memories 620. The one or more memories 620 may include instructions 622 stored thereon, which, when executed by the one or more processors 610, may cause the device 600 to perform operations related to the network slice certificate orchestrator 108 as described above.

[0076] Fig.10 7 is a schematic block diagram showing an apparatus 700 according to an exemplary embodiment of the present disclosure. The apparatus 700 may be implemented as the management system 106 described above.

[0077] refer to Fig.10 , the device 700 may include one or more processors 710 and one or more memories 720. The one or more memories 720 may include instructions 722 stored thereon that, when executed by the one or more processors 710, may cause the device 700 to perform operations associated with the management system 106 as described above.

[0078] The processors 610, 710 may be of any suitable type suitable for the local technical network, and may include one or more of the following: a general purpose processor, a dedicated processor, a microprocessor, a digital signal processor (DSP), one or more processors in a processor-based multi-core processor architecture, and a dedicated processor, such as a processor developed based on a field programmable gate array (FPGA) and an application specific integrated circuit (ASIC). The processors 610, 710 may be configured to control the other elements of the devices 600, 700, respectively, and operate in conjunction with them to perform the above-mentioned processes.

[0079] The memory 620, 720 may include at least one storage medium in various forms, such as volatile media and / or non-volatile media. Volatile memory may include, but is not limited to, for example, random access memory (RAM) or cache. Non-volatile memory may include, but is not limited to, for example, read-only memory (ROM), hard disk, flash memory, etc. In addition, the memory 620, 720 may include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or devices, or any combination of the above.

[0080] Some exemplary embodiments also provide computer program codes or instructions that, when executed by one or more processors, enable the device or apparatus to perform the above-described processes. The computer program codes or instructions for performing the processes of the exemplary embodiments may be written in any combination of one or more programming languages. The computer program codes or instructions may be provided to one or more processors or controllers of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the program codes or instructions are executed by the processors or controllers, the functions / operations specified in the flow charts and / or block diagrams are implemented. The program codes or instructions may be executed entirely on the machine, partially on the machine, as a separate software package, partially on the computer and partially on a remote machine, or entirely on a remote machine or server.

[0081] Some exemplary embodiments also provide a non-transitory computer program product or a non-transitory computer-readable medium in which a computer program code or instruction is stored. The term "non-transitory" as used herein is a limitation on the medium itself (i.e., tangible, not a signal), rather than a limitation on the persistence of data storage (e.g., RAM and ROM). A non-transitory computer-readable medium may be any tangible medium that may contain or store a program that may be used by or associated with an instruction execution system, device, or apparatus. A computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. A computer-readable medium may include, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the above. More specific examples of computer-readable storage media would include an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above devices.

[0082] It should be understood that the blocks in the drawings can be implemented in various ways including software, hardware, firmware or any combination thereof. In some embodiments, one or more blocks may be implemented using software and / or firmware, such as machine executable instructions stored in a storage medium. In addition to or in place of machine executable instructions, some or all of the blocks in the drawings may be implemented at least in part by one or more hardware logic components. For example, but not limited to, exemplary types of hardware logic components that can be used include field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), etc.

[0083] In addition, although the operations are described in a particular order, this should not be understood as requiring that the operations be performed in the particular order shown or in sequential order, or that all of the operations shown be performed to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. Similarly, although several specific implementation details are included in the above discussion, these should not be interpreted as limitations on the scope of the present disclosure, but rather as descriptions of features that may be unique to a particular embodiment. Certain features described in the context of a separate embodiment may also be implemented in combination in a single embodiment. On the contrary, the various features described in the context of a single embodiment may also be implemented in multiple embodiments individually or in any suitable sub-combination.

[0084] Although the subject matter has been described in language specific to structural features and / or methodological acts, it is to be understood that the subject matter defined in the appended claims is not limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as examples of implementing the claims.

[0085] As used herein, “at least one of: ” and “at least one of ” and similar expressions, where a list of two or more elements is connected by “and” or “or”, refer to at least any one element, or at least any two or more elements, or at least all the elements.

[0086] Certain abbreviations that may be found in the specification and drawings are defined as follows:

[0087] 3GPP Third Generation Partnership Project

[0088] 5G fifth generation wireless technology

[0089] AN access network

[0090] CA Certification Agency

[0091] CN Core Network

[0092] CRL Certificate Revocation List

[0093] DNS Domain Name System

[0094] NF Network Function

[0095] NSCO Network Slicing Certificate Orchestrator

[0096] NSMF network slice management function

[0097] OAM operation management and maintenance

[0098] OCSP Online Certificate Status Protocol

[0099] RA Registration Agency

[0100] S-NSSAI Single Network Slice Selection Auxiliary Information

[0101] TN transmission network

[0102] URL Uniform Resource Locator

Claims

1. A network slice certificate orchestrator, comprising: at least one processor; as well as At least one memory storing instructions that, when executed by at least one processor thereof, cause the network slice certificate orchestrator to perform at least the following operations: receiving, from a management system, a certificate authority configuration indicating a certificate authority configured for one or more network slices; as well as Transmitting a certificate request regarding a network function assigned to one of the one or more network slices and information of the certification authority configured for the one or more network slices to a registration authority or a certification authority.

2. The network slice certificate orchestrator according to claim 1, wherein: The certification authority configuration includes at least one of the following: a list of the one or more network slices; an internet protocol address or uniform resource locator of the certification authority configured for the one or more network slices; information of a domain name system server configured to resolve the uniform resource locator of the certification authority; or The purpose of the certification body.

3. The network slice certificate orchestrator according to claim 2, wherein: The purpose of the certification authority indicates whether the certification authority is a root certification authority or a subordinate certification authority for the one or more network slices.

4. A network slice certificate orchestrator as claimed in any preceding claim, wherein: The certificate request for the network function is received from a network slice orchestrator.

5. A network slice certificate orchestrator as claimed in any preceding claim, wherein: The at least one memory further stores instructions that, when executed by the at least one processor, cause the network slice certificate orchestrator to at least: receiving from the registration authority or the certification authority a network function certificate signed by the certification authority configured for the one or more network slices; as well as The signed certificate is sent to the network function.

6. The network slice certificate orchestrator according to claim 5, wherein: In the case where the certification authority is a subordinate certification authority configured for the one or more network slices, in addition to the certificate for the network function signed by the subordinate certification authority, the network slice certificate orchestrator also receives from the registration authority or the subordinate certification authority a trust chain from the subordinate certification authority to the root certification authority associated with the subordinate certification authority, and the trust chain is transmitted to the network function together with the certificate for the network function signed by the subordinate certification authority.

7. The network slice certificate orchestrator according to claim 6, wherein: The chain of trust includes a chain of certificates ultimately signed by the root certification authority.

8. The network slice certificate orchestrator according to any one of claims 5 to 7, wherein: The signed certificate is sent to the network function directly or via the network slice orchestrator.

9. A management system comprising: at least one processor; as well as At least one memory storing instructions that, when executed by the at least one processor, cause the management system to perform at least the following operations: Establish a secure connection with the network slice certificate orchestrator; as well as Transmitting to the network slice certificate orchestrator a certificate authority configuration indicating a certificate authority configured for one or more network slices.

10. The management system according to claim 9, wherein: The certification authority configuration includes at least one of the following: A list of one or more network slices; an internet protocol address or uniform resource locator of the certification authority configured for the one or more network slices; information of a domain name system server configured to resolve the uniform resource locator of the certification authority; or The purpose of the certification body.

11. The management system according to claim 10, wherein: The purpose of the certification authority indicates whether the certification authority is a root certification authority or a subordinate certification authority for the one or more network slices.

12. A method comprising: receiving, from the management system, a certification authority configuration indicating a certification authority configured for one or more network slice configurations; as well as Transmitting a certificate request regarding a network function assigned to one of the one or more network slices and information of the certification authority configured for the one or more network slices to a registration authority or a certification authority.

13. The method of claim 12, wherein: The certification authority configuration includes at least one of the following: a list of the one or more network slices; an internet protocol address or uniform resource locator of the certification authority configured for the one or more network slices; information of a domain name system server configured to resolve the uniform resource locator of the certification authority; or The purpose of the certification body.

14. The method of claim 13, wherein: The purpose of the certification authority indicates whether the certification authority is a root certification authority or a subordinate certification authority for the one or more network slices.

15. The method according to any one of claims 12 to 14, wherein: The certificate request for the network function is received from a network slice orchestrator.

16. The method of any one of claims 12 to 15, further comprising: receiving from the registration authority or the certification authority a certificate of a network function signed by the certification authority configured for one or more network slice configurations; as well as The signed certificate is transmitted to the network function.

17. The method of claim 16, wherein: In the case where the certification authority is a subordinate certification authority configured for the one or more network slices, in addition to the certificate of the network function signed by the subordinate certification authority, a trust chain from the subordinate certification authority to a root certification authority associated with the subordinate certification authority is received from the registration authority or the subordinate certification authority, and the trust chain is transmitted to the network function together with the certificate of the network function signed by the subordinate certification authority.

18. The method of claim 17, wherein: The chain of trust includes a chain of certificates ultimately signed by the root certification authority.

19. The method according to any one of claims 16 to 18, wherein: The signed certificate is sent to the network function directly or via the network slice orchestrator.

20. The method of any one of claims 12 to 19, wherein: The method is performed by a network slice certificate orchestrator.

21. A method comprising: Establish a secure connection with the network slice certificate orchestrator; as well as Transmitting to the network slice certificate orchestrator a certificate authority configuration indicating a certificate authority configured for one or more network slice configurations.

22. The method of claim 21, wherein: The certification authority configuration includes at least one of the following: a list of the one or more network slices; an internet protocol address or uniform resource locator of the certification authority configured for the one or more network slices; information of a domain name system server configured to resolve the uniform resource locator of the certification authority, the domain name system server; or The purpose of the certification body.

23. The method of claim 22, wherein: The purpose of the certification authority indicates whether the certification authority is a root certification authority or a subordinate certification authority for the one or more network slices.

24. The method of any one of claims 21 to 23, wherein: The method is executed by a management system.

25. An apparatus comprising: means for receiving, from a management system, a certificate authority configuration indicative of a certificate authority configured for one or more network slices; as well as A device for transmitting a certificate request regarding a network function assigned to one of the one or more network slices and information of the certification authority configured for the one or more network slices to a registration authority or a certification authority.

26. The apparatus of claim 25, wherein: The apparatus further comprises means for performing the method of any one of claims 13 to 20.

27. The apparatus of claim 25 or 26, wherein: The device includes a network slice certificate orchestrator, which is a network slice certificate orchestrator, or is included in a network slice certificate orchestrator.

28. An apparatus comprising: means for establishing a secure connection with a network slice certificate orchestrator; as well as Means for transmitting to the network slice certificate orchestrator a certification authority configuration indicating a certification authority configured for one or more network slices.

29. The apparatus of claim 28, wherein: The apparatus further comprises means for performing the method of any one of claims 22 to 24.

30. The apparatus of claim 28 or 29, wherein: The device comprises a management system, is a management system or is comprised in a management system.

31. A computer readable medium comprising instructions which, when executed by an apparatus, cause the apparatus to at least: receiving, from the management system, a certificate authority configuration indicating a certificate authority configured for one or more network slices; and Transmitting a certificate request regarding a network function assigned to one of the one or more network slices and information of the certification authority configured for the one or more network slices to a registration authority or a certification authority.

32. A computer readable medium comprising instructions which, when executed by an apparatus, cause the apparatus to at least: Establishing a secure connection with the network slice certificate orchestrator; and Transmitting to the network slice certificate orchestrator a certificate authority configuration indicating a certificate authority configured for one or more network slices.

Images