NRF CA Certificate Handling in 5G Core Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The management of Certificate Authority (CA) certificates in a core network domain is complex and costly, especially in large-scale 5G communication systems, and requires frequent updates of access control lists (ACLs) when token-based authorization is not used, leading to operational complexities.
Innovation Solution
An apparatus and method for efficiently handling CA certificates in a core network domain by registering network function (NF) profiles, including CA certificates, and using these certificates for validation during mutual TLS handshakes, with optional extension of NF profiles to include additional identifiers for enhanced security and discovery processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If mTLS is used for security, then authentication reliability is improved, but device complexity increases due to mandatory CA certificate life-cycle management
Solution Approach 1:
The NRF acts as an intermediary between NFs and CA certificates. Instead of NFs directly managing complex certificate life-cycles, the NRF stores CA certificates in NF profiles and distributes them to consuming NFs, simplifying the management process while maintaining mTLS security
Solution Approach 2:
CA certificates are registered and stored in the NRF in advance as part of NF profiles. This preliminary action allows consuming NFs to obtain certificates automatically during service discovery, eliminating the need for complex runtime certificate management
2Ease of manufacture
If token-based authorization is not used, then implementation cost is reduced, but device complexity increases due to ACL configuration requirements
Solution Approach 1:
NFs automatically obtain CA certificates from the NRF during service discovery without manual ACL configuration. The system self-services the authorization setup by embedding certificates in NF profiles, eliminating the need for operators to manually configure ACLs on each NF
Solution Approach 2:
The authorization mechanism is extracted from traditional ACL-based approaches and replaced with certificate-based validation. Instead of configuring access control lists, the system extracts the authorization logic to validate certificates obtained from NF profiles
3Reliability
If manual ACL updates are performed for new NF instances, then access control reliability is maintained, but productivity decreases due to operational complexity
Solution Approach 1:
The system implements automatic feedback loops where the NRF monitors NF registrations and automatically distributes relevant CA certificates to consuming NFs. This feedback mechanism ensures access control reliability is maintained without manual intervention, allowing rapid NF deployment
4Reliability
If CA certificates are validated locally in each NF, then authentication reliability is maintained, but device complexity increases due to integration requirements
Solution Approach 1:
The NRF provides universal certificate distribution services to all NFs. Instead of each NF implementing separate certificate management integrations, the NRF offers a unified multi-functional service that handles certificate storage, distribution, and updates for the entire network
Data Source
AI summary
A network repository function, NRF, in a core network domain of a mobile communication network is provided, wherein the NRF is configured to register network function, NF, profiles for NF discovery, and wherein NF certificates have been issued to the NFs, each NF certificate including a public key of the respective NF and at least one signature of at least one certification authority, CA. The NRF is configured to receive, from a registering NF having an NF certificate, profile information comprising an NF identity of the registering NF, an NF type of the registering NF, and at least one CA certificate of at least one CA that signed the NF certificate issued to the registering NF. The NRF is further configured to store the received profile information in a repository.