Network Function Certificate Verification for Secure Communications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network security is compromised when a network entity counterfeits another entity, leading to information theft and reduced security due to unauthorized access using stolen private keys.
Innovation Solution
A communication method that involves signing initial certificates for network function entities and revoking them upon request, ensuring that revoked certificates are recorded in certificate revocation lists or OCSP responders, thereby preventing attackers from obtaining end entity certificates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If initial certificates are signed and issued to network function entities, then network entities can authenticate each other and communicate securely, but if private keys are leaked or entities are compromised, the network security is compromised until certificates are manually revoked
Solution Approach 1:
The patent establishes a certificate revocation mechanism that is prepared in advance through the creation and distribution of CRLs (Certificate Revocation Lists) and OCSP responders (Online Certificate Status Protocol). These revocation infrastructure components are set up beforehand so that when a certificate needs to be revoked, the process can immediately utilize the pre-established infrastructure to notify network entities of the revocation status.
Solution Approach 2:
The patent implements a feedback mechanism where the status of certificates (valid or revoked) is continuously monitored and communicated back to network entities. Through CRL distribution and OCSP responses, the system provides real-time feedback about certificate validity, allowing network entities to immediately adjust their behavior based on current certificate status information.
2Reliability
If certificate revocation is implemented through CRL or OCSP, then revoked certificates can be detected, but the complexity of the certificate management system increases
Solution Approach 1:
The patent introduces intermediary components (CRL distribution points and OCSP responders) that mediate between the certificate authority and network entities. These intermediaries handle the complex tasks of tracking, storing, and communicating certificate status information, thereby simplifying the burden on individual network entities while maintaining comprehensive certificate revocation capability across the network.
Data Source
Figure 1~3
Figure 4~5
Figure 6
AI summary
Embodiments of this application provide a communication method and an apparatus. The method includes: A second entity receives a request message from a network function entity, where the request message includes an initial certificate signed by a first entity for the network function entity and identity information of the network function entity, and the first entity is a trusted entity of the second entity; verifies consistency between the initial certificate signed by the first entity for the network function entity and the identity information of the network function entity; and signs an end entity certificate for the network function entity when a verification result is that the verification succeeds. According to the method, the second entity may refuse to sign the end entity certificate based on inconsistency between the initial certificate and an identity forged by an attacker or an identity of a malicious network function entity, to prevent the attacker or the malicious network function entity from obtaining the end entity certificate, using the end entity certificate to communicate with another network function entity in a network, and stealing information from the another network function entity, thereby improving network communication security.