Network Function Registration Authorization via Vault Service
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing wireless standards lack dynamic authorization mechanisms to prevent unauthorized network functions (NFs) from registering within a wireless communication system, particularly in web-scale environments, where 'rogue' NFs can register with the Network Function Registration Function (NRF) using conventional IP-based approaches.
Innovation Solution
A container orchestration platform (COP) is used to manage and authorize NFs by provisioning authorization codes (authcodes) to a vault service, which then forwards them to the NRF for validation, ensuring only authorized NFs can register by matching these codes, thereby preventing unauthorized registration attempts from rogue NFs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional IP-based routing approaches are used for NF registration, then routing simplicity is maintained, but security against rogue NF registration is insufficient
Solution Approach 1:
The system performs preliminary authorization by provisioning authcodes to NFs before they can register with the NRF. The COP provisions authcodes to vault services, which then provide them to NFs during instantiation. This pre-authorization mechanism ensures that only authorized NFs can successfully register, preventing rogue NF infiltration while maintaining a structured authorization framework
Solution Approach 2:
The vault service acts as an intermediary between the COP and NFs for authcode management. The vault service receives authcodes from the COP, stores them securely, and provides them to NFs when needed. This intermediary layer simplifies the authorization mechanism by centralizing authcode management while providing security against unauthorized registration
2Reliability
If dynamic authorization mechanisms are implemented to prevent rogue NF registration, then security is improved, but system complexity increases
Solution Approach 1:
The authcode mechanism serves multiple functions: it acts as an authorization credential for NF registration, a security token for preventing rogue NF infiltration, and a dynamic provisioning element that can be updated by the COP. This multi-functional approach improves authorization security while avoiding the need for separate complex security infrastructure
Solution Approach 2:
The system implements feedback through the NRF's validation of authcodes during NF registration. When an NF attempts to register, the NRF validates its authcode against the authorized list and provides feedback by either accepting or rejecting the registration. This feedback mechanism ensures continuous security validation while maintaining streamlined registration management
Data Source
AI summary
A device, method, and system for forwarding, to a pod, a utility container associated with each of at least one network service for enabling a pre-registration of a network function (NF) with an NF registration function (NRF); sending, from the utility container, an authorization code to an NF authorization platform, wherein the authorization code is associated with the at least one network service; suspending a registration procedure for the NF with the NRF until the authorization code is forwarded from the NF authorization platform to the NRF; and resuming, responsive to a service registration request, the registration procedure based on a validation of the authorization code identified in the service registration request.