Dynamic Trust Credentials for 5G Network Functions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current X.509v3 certificate provisioning processes in 5G networks lack mechanisms to verify the authorization and unique characteristics of network functions (NFs), leading to potential impersonation attacks and improper certificate issuance, which can degrade network security and expose subscriber information.
Innovation Solution
The system generates a Certificate Request Token (CRT) and a Platform Characteristics Token (PCT) to ensure accurate identity verification and tailored certificate issuance, leveraging trust anchors to prevent misbehaving NFs from obtaining unauthorized certificates and ensuring proper scope and duration of certificate usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional X.509v3 certificate provisioning is used, then certificate issuance is simple and fast, but network security is compromised due to lack of verification mechanisms
Solution Approach 1:
The system performs preliminary actions by generating a Certificate Request Token (CRT) and Platform Characteristics Token (PCT) before certificate issuance. The CRT is generated by the management function and the PCT is generated by the trusted attestation engine based on platform characteristics, ensuring verification mechanisms are in place before the actual certificate is issued to the network function.
Solution Approach 2:
The patent introduces intermediary components including the trusted attestation engine that generates PCT based on platform characteristics, and the management function that generates CRT. These intermediaries mediate between the network function and the certificate authority, providing verification of identity and characteristics without requiring direct complex interactions between all parties.
2Reliability
If certificate verification mechanisms are added, then impersonation attacks are prevented, but the provisioning process becomes more complex
Solution Approach 1:
Identity verification is performed in advance through the generation of CRT and PCT tokens before the actual certificate issuance. The trusted attestation engine verifies platform characteristics and generates PCT, while the management function generates CRT, ensuring identity verification is completed preliminarily rather than during the certificate issuance itself.
Solution Approach 2:
The trusted attestation engine acts as an intermediary that simplifies identity verification by generating PCT based on platform characteristics. This intermediary handles the complex verification of NF identity and characteristics, reducing the burden on other system components and streamlining the overall process.
3Reliability
If dynamic trust credentials are implemented, then certificate scope and duration are controlled, but system complexity increases
Solution Approach 1:
The system establishes trust credentials preliminarily by generating CRT and PCT tokens with embedded verification data before certificate issuance. This preliminary establishment of trust credentials includes platform characteristics and authorization information that will control the scope and duration of the issued certificate, avoiding the need for complex dynamic adjustments later.
Solution Approach 2:
The management function and trusted attestation engine serve as intermediaries that handle the complexity of trust credential management. They generate and manage CRT and PCT tokens that encode the scope and duration controls, shielding the rest of the system from direct interaction with complex credential control mechanisms.
Data Source
AI summary
Systems and methods leverage trust anchors to generate tokens which can then be used by network functions (NFs). A virtualization infrastructure manager (VIM) for a virtualized platform receives a NF software package and a certificate request token (CRT) from a management function. The NF is a virtual NF, a containerized NF, or another virtual entity (xNF) to be deployed. The CRT is digitally signed by the management function and includes a network address of a trust anchor platform and a NF profile. The VIM deploys the NF and provides the CRT to the NF. The NF obtains from the CRT the network address of the trust anchor platform, generates a certificate signing request (CSR) for a digital certificate, and submits the CSR and the CRT to the trust anchor platform. The NF receives a digital certificate from the trust anchor platform based on validation of both the CSR and CRT.