Systems and methods for managing public key infrastructure certificates for components of a network

Patent metadata

Field	Value
Publication number	US-12500778-B2
Application number	US-202016883590-A
Country	US
Kind code	B2
Filing date	May 26, 2020
Priority date	May 26, 2020
Publication date	Dec 16, 2025
Grant date	Dec 16, 2025

Abstract

A device may determine that a network function of a network has been instantiated to facilitate communication via the network. The device may request a certificate authority to provide a certificate for the network function. The device may receive, from the certificate authority, the certificate. The device may generate a certificate profile to enable other network functions of the network to authenticate communications with the network function, wherein the certificate profile identifies: the certificate and a certification protocol. The device may provide, to the network function, the certificate profile to cause the network function to use the certificate to communicate with the other network functions.

First claim

What is claimed is:

1 . A method, comprising:
receiving, by a device, a notification that a network function of a network has been instantiated to facilitate communication via the network,
wherein the notification includes an identifier associated with the network function;
determining, by the device and based on identifying the identifier in a data structure, a type of the network function, an operation to be performed by the network function, and a communication protocol associated with the network function; determining, by the device to obtain a certificate for the network function, wherein the determining is based on:
determining the type of the network function,
determining the operation to be performed by the network function,
determining that the communication protocol is associated with the network function, and
determining that the communication protocol is not a protocol for communicating with a certificate authority;
generating, by the device and based on receiving the notification that the network function of the network has been instantiated, a key pair that includes a private key and a public key; storing, by the device, the private key; transmitting, by the device and to a private certificate authority, a request for the certificate,
wherein the private certificate authority, the device, and the network function are associated with a same host platform, and
wherein the request for the certificate includes:
information identifying the network function,
information identifying the device,
information identifying the communication protocol associated with the network function; and
the public key;

receiving, by the device and from the private certificate authority, the certificate,
wherein the certificate is received based on a verification of an identity of the network function that is based on a determination that the network function and the private certificate authority are included in another network associated with a service provider,
wherein the determination that the network function and the private certificate authority are included in the other network associated with the service provider is based on determining that the private certificate authority and the network function are of a same host platform;

generating, by the device, a certificate profile to enable other network functions of the network to authenticate communications with the network function,
wherein the certificate profile identifies:
the certificate,
a certification protocol associated with the private certificate authority, and
the private key; and

providing, by the device and to the network function, the certificate profile to cause the network function to use the certificate to communicate with the other network functions.

2 . The method of claim 1 ,
wherein receiving the notification that the network function has been instantiated comprises:
receiving, from a network function orchestrator of the network, the notification.

3 . The method of claim 1 , further comprising:
generating a request for the certificate,
wherein the request for the certificate identifies an application programming interface of the network function; and
wherein the private certificate authority is configured to generate the certificate based on the application programming interface.

4 . The method of claim 1 ,
wherein the other network functions are configured to authenticate the communications with the network function based on the other network functions providing the certificate to the certificate authority in association with the certification protocol.

5 . The method of claim 1 ,
wherein the certification protocol comprises at least one of:
a certificate management protocol,
a simple certificate enrollment protocol, or
an enrollment over secure transport protocol.

6 . The method of claim 1 ,
wherein the certificate authority is a first intermediate certificate authority associated with a first network infrastructure, the method further comprising: instantiating a second intermediate authority associated with a second network infrastructure that is different from the first network infrastructure.

7 . The method of claim 1 ,
wherein the network function comprises a virtual network function of a core network of the network.

8 . A device, comprising:
one or more memories; and one or more processors configured to:
receive a notification that a containerized network function of a network has been instantiated to facilitate communication via the network;
wherein the notification includes an identifier associated with the containerized network function;

determine, based on identifying the identifier in a data structure, a type of the containerized network function, an operation to be performed by the containerized network function, and a communication protocol associated with the containerized network function;
determine to obtain a certificate for the containerized network function based on determining that the communication protocol is not a protocol for communicating with a certificate authority;
generate a certificate profile to enable other containerized network functions of the network to authenticate communications with the containerized network function,
wherein the containerized network function and the other containerized network functions are associated with a containerized core network infrastructure,
wherein the certificate profile identifies a private certificate authority associated with the containerized core network infrastructure and includes:
the certificate of the containerized network function, information identifying a certification protocol of the containerized core network infrastructure, and
a private key, and

wherein the certificate is obtained based on a verification of an identity of the containerized network function that is based on a determination that the containerized network function and the private certificate authority are included in another network associated with a service provider,
wherein the determination that the containerized network function and the private certificate authority are included in the other network associated with the service provider is based on determining that the private certificate authority and the containerized network function are of a same host platform; and

provide, to the containerized network function, the certificate profile to cause the containerized network function to use the certificate profile to communicate with the other containerized network functions.

9 . The device of claim 8 ,
wherein the containerized network function is associated with a proxy of the containerized core network infrastructure, and
wherein the certificate is associated with the proxy.

10 . The device of claim 8 ,
wherein the one or more processors, when generating the certificate profile, are configured to:
identify a proxy associated with the containerized network function;
determine the certification protocol based on the proxy; and
generate the certificate of the containerized network function based on the certification protocol.

11 . The device of claim 8 ,
wherein the one or more processors, when generating the certificate profile, are configured to:
determine the certification protocol based on the type of the containerized network function; and
generate the certificate of the containerized network function based on the certification protocol.

12 . The device of claim 8 ,
wherein the private certification authority is a dedicated certificate authority that is associated with a manager of the containerized core network in

Assignees

• Verizon Patent & Licensing Inc

Inventors

• Mahajan Amit
• Laad Jayesh Kumar

Classifications

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• G06F9/455

  Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines · CPC title

• H04L2209/76

  Proxy, i.e. using intermediary entity to perform cryptographic operations · CPC title

• H04L9/3268 Primary

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title

• H04L63/0281

  Proxies · CPC title