Systems and methods for configuring a network function proxy for secure communication

Patent metadata

Field	Value
Publication number	US-11855977-B2
Application number	US-202218045890-A
Country	US
Kind code	B2
Filing date	Oct 12, 2022
Priority date	May 26, 2020
Publication date	Dec 26, 2023
Grant date	Dec 26, 2023

Abstract

A device may determine that a network function of a network is to use a secure communication protocol. The network function may be configured to facilitate communication via the network. The device may identify a component of a resource configuration that is to instantiate the network function. The device may instantiate, using the component, a proxy for the network function. The device may configure the proxy to obtain a certificate that is associated with the secure communication protocol. The device may cause the proxy to use the certificate to communicate with another proxy that is associated with the network function to perform an operation associated with the network function.

First claim

What is claimed is:

1. A method, comprising:
instantiating, by a device, a virtual network function for a communication session with a user equipment (UE);
instantiating, by the device, a distributed proxy associated with the virtual network function;
receiving, by the device, a certificate signing request from the distributed proxy;
obtaining, by the device and from a certificate authority of a public key infrastructure, a certificate for the distributed proxy based on the certificate signing request;
generating, by the device, a certificate profile for the distributed proxy based on obtaining the certificate;
providing, by the device, the certificate profile to the distributed proxy to enable the virtual network function to utilize the certificate to communicate with the UE via the communication session; and
authenticating the virtual network function based on receiving the certificate signing request from the distributed proxy.

2. The method of claim 1 , wherein authenticating the virtual network function comprises:
determining that the virtual network function is instantiated by the device; and
authenticating the virtual network function based on the virtual network function being instantiated by the device.

3. The method of claim 1 , wherein authenticating the virtual network function comprises:
determining that the distributed proxy is associated with the virtual network function; and
authenticating the virtual network function based on the distributed proxy being associated with the virtual network function.

4. The method of claim 1 , further comprising:
determining that a quantity of communication sessions associated with a network satisfies a threshold quantity of communication sessions.

5. The method of claim 4 , wherein the virtual network function is instantiated based on the quantity of communication sessions associated with the network satisfying the threshold quantity of communication sessions.

6. The method of claim 1 , wherein the distributed proxy includes a master proxy and a plurality of proxies associated with respective components of the virtual network function, and wherein the master proxy utilizes the certificate to securely communicate data between components of the virtual network function via the plurality of proxies.

7. The method of claim 1 , wherein the distributed proxy includes a master proxy and a plurality of proxies associated with respective components of the virtual network function, and wherein the master proxy utilizes the certificate to issue certificates to the plurality of proxies to enable a secure communication of data between the respective components of the virtual network function via the plurality of proxies.

8. A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
instantiate a virtual network function for a communication session with a user equipment (UE);
instantiate a distributed proxy associated with the virtual network function;
receive a certificate signing request from the distributed proxy;
obtain, from a certificate authority of a public key infrastructure, a certificate for the distributed proxy based on the certificate signing request;
generate a certificate profile for the distributed proxy based on obtaining the certificate;
provide the certificate profile to the distributed proxy to enable the virtual network function to utilize the certificate to communicate with the UE via the communication session; and
authenticate the virtual network function based on receiving the certificate signing request from the distributed proxy.

9. The non-transitory computer-readable medium of claim 8 , wherein the one or more instructions, that cause the device to authenticate the virtual network function, cause the device to:
determine that the virtual network function is instantiated by the device; and
authenticate the virtual network function based on the virtual network function being instantiated by the device.

10. The non-transitory computer-readable medium of claim 8 , wherein the one or more instructions, that cause the device to authenticate the virtual network function, cause the device to:
determine that the distributed proxy is associated with the virtual network function; and
authenticate the virtual network function based on the distributed proxy being associated with the virtual network function.

11. The non-transitory computer-readable medium of claim 8 , wherein the one or more instructions further cause the device to:
determine that a quantity of communication sessions associated with a network satisfies a threshold quantity of communication sessions.

12. The non-transitory computer-readable medium of claim 11 , wherein the virtual network function is instantiated based on the quantity of communication sessions associated with the network satisfying the threshold quantity of communication sessions.

13. The non-transitory computer-readable medium of claim 8 , wherein the distributed proxy includes a master proxy and a plurality of proxies associated with respective components of the virtual network function, and wherein the master proxy utilizes the certificate to securely communicate data between components of the virtual network function via the plurality of proxies.

14. The non-transitory computer-readable medium of claim 8 , wherein the distributed proxy includes a master proxy and a plurality of proxies associated with respective components of the virtual network function, and wherein the master proxy utilizes the certificate to issue certificates to the plurality of proxies to enable a secure communication of data between the respective components of the virtual network function via the plurality of proxies.

15. A device, comprising:
one or more hardware processors configured to:
instantiate a virtual network function for a communication session with a user equipment (UE);
instantiate a distributed proxy associated with the virtual network function;
receive a certificate signing request from the distributed proxy;
obtain, from a certificate authority of a public key infrastructure, a certificate for the distributed proxy based on the certificate signing request;
generate a certificate profile for the distributed proxy based on obtaining the certificate;
provide the certificate profile to the distributed proxy to enable the virtual network function to utilize the certificate to communicate with the UE via the communication session; and
authenticate the virtual network function based on receiving the certificate signing request from the distributed proxy.

16. The device of claim 15 , wherein the one or more processors, to authenticate the virtual network function, are configured to:
determine that the virtual network function is instantiated by the device; and
authenticate the virtual network function based on one or more of:
the virtual network function being instantiated by the device, or
the distributed proxy being associated with the virtual network function.

17. The device of claim 15 , wherein the one or more processors are further configured to:
determine that a quantity of communication sessions associated with a network satisfies a threshold quantity of communication sessions.

18. The device of claim 7 , wherein the virtual network function is instantiated based on the quantity of communication sessions associated with the network satisfying the threshold quantity of comm

Assignees

• Verizon Patent & Licensing Inc

Inventors

• Mahajan Amit
• Laad Jayesh Kumar
• Bittenbender John M

Classifications

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L9/3268

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title

• H04L47/82

  Miscellaneous aspects · CPC title

• H04L63/0281

  Proxies · CPC title

• H04L63/0869

  for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273) · CPC title