NRF Access Token Key Updates for 5GC Service Continuity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The 3GPP specifications lack a defined key management procedure for NRF access token public keys, leading to manual re-provisioning during security attacks and inadequate management of keys at different service access levels, which disrupts service continuity and limits flexibility in 5G network security.
Innovation Solution
Implementing an automatic key management system at the NRF for provisioning, renewing, and revoking access token public keys, allowing subscription-based notifications for status updates, and managing keys at various service access levels such as PLMN, network slice, and NF type.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual re-provisioning of keys is performed during security attacks, then security can be maintained, but service continuity is disrupted
Solution Approach 1:
The system performs preliminary actions by establishing automatic key management procedures and subscription notification mechanisms before security incidents occur. The NRF proactively manages key lifecycle events and notifies subscribed NFs in advance of key status changes, eliminating the need for disruptive manual intervention during security attacks.
Solution Approach 2:
The system implements self-service through automatic key management where the NRF autonomously handles key provisioning, renewal, and revocation. Subscribed NFs automatically receive notifications and update their local key caches without human intervention, enabling the system to maintain security while ensuring service continuity during key lifecycle events.
2Device complexity
If keys are managed at a single access level, then management is simplified, but flexibility in service access control is limited
Solution Approach 1:
The system segments key management into multiple hierarchical access levels including PLMN-level, network slice-level, and NF-type-level keys. Each level serves specific service access control requirements, enabling flexible authorization decisions while maintaining organized, manageable key structures through clear segmentation boundaries.
Solution Approach 2:
The unified key management system performs multiple functions across different service access levels. The same NRF infrastructure and notification mechanism serve PLMN-level, slice-level, and NF-type-level key management, providing universal service while supporting differentiated access control requirements through multi-functionality.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
A method for automatic key management of network access token public keys for 5GC authorization to mitigate security attacks includes providing, at the NRF, a network access token public key status update notification subscription interface that allows producer NFs to subscribe to receive notifications of updates in status of service access token public keys issued by the NRF. When the NRF determines that an update in status of a service access token public key is required, the NRF updates the status of the public key in its local database and notifies producer NFs that have subscribed to receive the updates. The producer NFs use the public keys to validate service requests from consumer NFs. In one variation, the NRF maintains and updates the status of service access token public keys associated with different service access levels.