Systems and methods for secure virtualized base station orchestration

Patent metadata

Field	Value
Publication number	US-12010510-B2
Application number	US-202217856164-A
Country	US
Kind code	B2
Filing date	Jul 1, 2022
Priority date	Jul 2, 2021
Publication date	Jun 11, 2024
Grant date	Jun 11, 2024

Abstract

In one embodiment, a method for secure virtualized wireless base station orchestration comprises: obtaining a node certificate and private key from a global CA defining a PKI signing certificate/private key; obtaining a sub CA certificate/private key from either an edge cloud node cluster or the global CA, using a PKI request signed using the PKI signing certificate/private key; establishing an orchestration access IPsec tunnel to a cloud comprising edge cloud orchestration functions; utilizing the orchestration functions to deploy on the node virtualized entities comprising VNFs of a wireless base station; obtaining at least one VNF certificate and private key for the VNFs from the global CA using a PKI request signed using the global certificate/private key; utilizing the VNF certificate/private key, establishing IPsec tunnels between the VNFs and a wireless network services operator network and/or to an OAM secure gateway for a DMS.

First claim

What is claimed is:

1. A method for secure virtualized wireless base station orchestration on a node of a scalable cloud environment, the method comprising:
obtaining a node certificate and a node private key from a global certificate authority (CA) using a first Public Key Infrastructure (PKI) request signed using a global certificate and a global private key, wherein the node certificate and the node private key defines a PKI signing certificate and a PKI signing private key;
establishing an orchestration access IPsec tunnel to an orchestration central cloud comprising one or more functions for edge cloud orchestration;
utilizing, via the orchestration access IPsec tunnel, the one or more functions for edge cloud orchestration to deploy on the node one or more virtualized entities comprising one or more virtual network functions of a wireless base station;
obtaining at least one virtual network function (VNF) certificate and at least one VNF private key for the deployed one or more virtualized entities from the global CA using at least one second PKI request signed using the global certificate and the global private key;
utilizing the at least one VNF certificate and the at least one VNF private key, establishing one or more IPsec tunnels comprising at least one of:
at least one X2 IPsec tunnel between the one or more virtual network functions of the wireless base station and a wireless network services operator network;
at least one S1/X2 IPsec tunnel between the one or more virtual network functions of the wireless base station and the wireless network services operator network;
at least one O1 IPsec tunnel to an Operations and Maintenance (OAM) secure gateway for a wireless base station Device Management System (DMS).

2. The method of claim 1 , wherein the node of the scalable cloud environment is a controller node of the edge cloud and the one or more virtualized entities comprise one or both of a central unit control-plane (CU-CP) VNF and a central unit user-plane (CU-UP) VNF.

3. The method of claim 2 , wherein the controller node generates an authorization token signed with the PKI signing certificate and the PKI signing private key for one or more compute nodes of the edge cloud, wherein the one or more compute nodes utilize the authorization token to obtain certificates and keys from the global certificate authority (CA).

4. The method of claim 1 , wherein the node of the scalable cloud environment is a compute node of the edge cloud and the one or more virtualized entities comprise at least one distribution node (DU) VNF,
the wireless base station further comprising one or more radio units (RU) coupled to the at least one DU VNF, the one or more radio units (RU) configured to implement a radio frequency (RF) interface and are deployed in a physical location where radio coverage is to be provided.

5. The method of claim 1 , wherein obtaining the node certificate and the node private key further comprises:
executing a PKI client application for acquiring the node certificate and the node private key from the global CA;
sending to the global CA a digital certificate and private key request for acquiring the node certificate and the node private key, wherein a digital certificate and private key used to sign the digital certificate and private key request is embedded and obfuscated within the PKI client application;
receiving from the global CA a digital certificate and private key response comprising the node certificate and the node private key, wherein the node private key received from the global CA is encrypted;
decrypting the encrypted node private key and storing the node private key with the node certificate.

6. The method of claim 1 , further comprising:
obtaining an edge cloud node cluster sub CA certificate and an edge cloud node cluster sub CA private key from either an edge cloud node cluster or from the global CA, using a third PKI request signed using the PKI signing certificate and the PKI signing private key.

7. The method of claim 6 , wherein obtaining the edge cloud node cluster sub CA certificate and the edge cloud node cluster sub CA private key comprises:
sending the third PKI request to acquire the edge cloud node cluster sub CA certificate and the edge cloud node cluster sub CA private key from the global CA;
receiving from the global CA an edge cloud node cluster sub CA certificate and private key response comprising the edge cloud node cluster sub CA certificate and the edge cloud node cluster sub CA private key, wherein the edge cloud node cluster sub CA private key received from the global CA is encrypted; and
decrypting the encrypted edge cloud node cluster sub CA private key and installing the edge cloud node cluster sub CA certificate and the edge cloud node cluster sub CA private key.

8. The method of claim 1 , wherein establishing the orchestration access IPsec tunnel to the orchestration central cloud comprises establishing the orchestration access IPsec tunnel though an orchestration and management network to couple cloud worker nodes hosting the one or more virtualized entities in the edge cloud of the scalable cloud environment to a cloud master node that implements the orchestration central cloud.

9. The method of claim 1 , wherein obtaining the at least one VNF certificate and the at least one VNF private key comprises:
sending the at least one second PKI request to acquire the at least one VNF certificate and the at least one VNF private key from a first VNF of the one or more virtualized entities to the global CA;
receiving from the global CA a VNF certificate and private key response comprising a first VNF certificate and a first VNF private key, wherein the first VNF private key received from the global CA is encrypted; and
decrypting the encrypted first VNF private key and storing the first VNF certificate and the first VNF private key.

10. The method of claim 1 , further comprising:
establishing at least one operator CA tunnel between the deployed one or more virtualized entities and a network operator CA secure gateway and acquire one or more sets of X2 IPsec certificate and X2 IPsec private key from an operator CA via the at least one operator CA tunnel.

11. The method of claim 1 , where the node comprises a VNF hosting platform for the one or more virtualized entities of the wireless base station, the VNF hosting platform comprising a processor coupled to a memory.

12. A Virtual Network Function (VNF) hosting platform for one or more virtualized entities of a wireless base station, the VNF hosting platform comprising:
a processor coupled to a memory, wherein the processor is configured to execute code to install and orchestrate a node of a virtualized wireless base station by:
obtaining a node certificate and a node private key from a global certificate authority (CA), wherein the node certificate and the node private key defines a Public Key Infrastructure (PKI) signing certificate and a PKI signing private key;
establishing an orchestration access IPsec tunnel to an orchestration central cloud comprising one or more functions for edge cloud orchestration;
utilizing, via the orchestration access IPsec tunnel, the one or more functions for edge cloud orchestration to deploy on the node the one or more virtualized entities comprising one or more virtual network functions of the wireless base station;
obtaining at least one VNF certificate and at least one VNF private key for the one or more virtual network functions from the global CA;
utilizing the at least one VNF certificate and the at least one VNF private key, establishing one or more IPsec tunnels comprising at least one of:
at least one X

Assignees

• Commscope Technologies Llc

Inventors

• Ni James J
• Ramakrishnan Shanthakumar
• Chan Tat Keung
• Medvinsky Alexander
• Venkatesh Prashanth
• Sambandan Devaraj

Classifications

• H04W12/084

  using delegated authorisation, e.g. open authorisation [OAuth] protocol · CPC title

• H04W12/03

  Protecting confidentiality, e.g. by encryption · CPC title

• H04W12/108

  Source integrity · CPC title

• H04W12/069

  using certificates or pre-shared keys · CPC title

• H04L63/0272

  Virtual private networks · CPC title