Layer 2 CNF Authentication for Secure Bootstrapping Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud-native platforms lack security measures for authenticating cloud-native functions (CNFs) during instantiation and bootstrapping, leading to potential unauthorized access and cyber threats, especially in multi-tenant environments.
Innovation Solution
Implementing Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) at the Ethernet layer (L2) for CNF authentication during onboarding, using a supplicant to initiate an EAP-TLS protocol sequence with an authentication server and controlling traffic based on the authentication result to ensure secure instantiation and bootstrapping.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cloud-native functions are onboarded without authentication during instantiation and bootstrapping, then the onboarding process is simple and fast, but security is compromised allowing unauthorized access and cyber threats
Solution Approach 1:
The patent applies preliminary action by performing authentication at the instantiation and bootstrapping stage, before the CNF becomes operational. The supplicant initiates EAP-TLS authentication with the authenticator during the onboarding process, ensuring security is established before the CNF can access the cloud-native platform, thus preventing unauthorized access from the outset
2Reliability
If EAP-TLS authentication is implemented at layer 2 during instantiation and bootstrapping, then security is improved by preventing unauthorized access, but the authentication and traffic control mechanisms become more complex
Solution Approach 1:
The patent employs an authenticator as an intermediary component that mediates between the supplicant (CNF) and the authentication server. The authenticator receives EAP-TLS authentication requests, communicates with the authentication server, and controls layer 2 traffic based on authentication results. This intermediary approach simplifies the overall system architecture by centralizing authentication logic and traffic control functions in a dedicated component
3Reliability
If all communications are blocked for unauthenticated CNFs except EAPoL, then security is enhanced by isolating unauthorized functions, but the authentication process becomes more stringent and complex
Solution Approach 1:
The patent applies local quality by allowing different types of traffic to be treated differently at the layer 2 level. Specifically, EAPoL (EAP over LAN) traffic is permitted for unauthenticated CNFs to enable the authentication process, while all other communications are blocked. This selective traffic handling approach ensures that authentication can proceed normally while maintaining security by isolating unauthorized functions from other platform resources
Data Source
AI summary
Example embodiments of the present disclosure relate to cloud-native function (CNF) authentication during the instantiation and bootstrapping of the CNF. According to embodiments, a method may be provided, including sending, by a supplicant to an authenticator during an instantiation and bootstrapping stage of a CNF, a message to initiate an Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) protocol sequence, wherein an EAP-TLS authentication is performed with an authentication server based on the message; receiving, by the supplicant, a result of the EAP-TLS authentication from the authenticator, wherein the result of the EAP-TLS authentication originates from the authentication server, and wherein the authenticator is configured to control traffic of the CNF based on the result of the EAP-TLS authentication.