SCP Certificate Verification Offload for 5G NF Security Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In 5G telecommunications networks, the verification of consumer NF security certificates by producer NFs leads to excessive network traffic and resource wastage due to repeated checks of X.509 certificate revocation, which burdens consumer NFs and certificate authority (CA) processing and memory resources.
Innovation Solution
The proposed solution involves offloading the verification of consumer NF security certificates to a Service Communication Proxy (SCP), which performs certificate checks on behalf of producer NFs, caching results, and only initiating OCSP requests for unique certificates, reducing redundant checks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If producer NFs perform certificate verification for each SBI request, then security validation is ensured, but network traffic and processing resources are excessively consumed
Solution Approach 1:
The SCP performs certificate verification in advance by validating the consumer NF's security certificate when it first presents a CCA token, obtaining the verification result from the CA before the producer NF needs to use it. This preliminary verification eliminates the need for repeated validations in subsequent requests, reducing network traffic and processing resources while ensuring security validation is completed beforehand.
Solution Approach 2:
The SCP acts as an intermediary between the consumer NF and the producer NF, taking over the certificate verification task from the producer NF. Instead of the producer NF directly verifying certificates, the SCP performs the verification on behalf of both parties, caching results and forwarding validated requests, thus reducing the burden on network resources while maintaining security.
2Reliability
If certificate verification is performed for every request, then security is maintained, but consumer NF and CA resources are wasted
Solution Approach 1:
The system performs certificate verification in advance when the consumer NF first authenticates with the SCP, storing the validation result. Subsequent requests from the same consumer NF use the cached verification result, eliminating redundant CA processing and improving productivity without compromising security.
Solution Approach 2:
The SCP caches certificate verification results, recovering the computational work done by the CA and consumer NF by reusing validation results across multiple requests. This prevents wasting CA processing resources and consumer NF memory resources on repeated verifications of the same certificate.
3Reliability
If repeated OCSP requests are sent for certificate validation, then certificate revocation is checked, but network bandwidth is consumed
Solution Approach 1:
The SCP performs OCSP requests to check certificate revocation status in advance, before forwarding requests to producer NFs. The verification results are cached and reused for subsequent requests involving the same consumer NF certificate, eliminating repeated OCSP calls and reducing network bandwidth consumption while maintaining reliable revocation checking.
Solution Approach 2:
The SCP acts as an intermediary that consolidates OCSP requests, performing revocation checks centrally rather than allowing each producer NF to send separate requests. This mediation reduces redundant network traffic for certificate validation while ensuring revocation status is properly checked.
Data Source
AI summary
A method for offloading verification of consumer NF security certificates includes receiving, by an SCP, an SBI request message including a consumer NF security token signed by a consumer NF for authenticating the consumer NF to a producer NF. The method further includes obtaining, by the SCP and from the consumer NF security token, an identifier for a consumer NF security certificate or a copy of the consumer NF security certificate. The method further includes verifying, by the SCP and on behalf of the producer NF, the consumer NF security certificate. The method further includes performing, by the SCP and based on a verification result of the consumer NF security certificate, a network security action.