System and method for automatic onboarding of network functions to a credential vault

Patent metadata

Field	Value
Publication number	US-2025077638-A1
Application number	US-202218023216-A
Country	US
Kind code	A1
Filing date	Dec 21, 2022
Priority date	Dec 21, 2022
Publication date	Mar 6, 2025
Grant date	—

Abstract

To automatically onboard network functions to a credential vault, a orchestration processor actuates establishment of an cluster account for a network cluster, and actuates a cluster configuration of a processor of the vault to enable authentication of a network cluster. For each of a plurality of network functions associated with the network cluster, the orchestration processor generates an identifier, sets values for parameters of an initialization parameter set, actuates assignment of access permissions for a code address on a memory of the vault, actuates assignment of elevated access permissions for a credential address on the vault memory, and actuates association of the network function with a cluster account of the network cluster. The vault memory thereby defines credential addresses each corresponding to a respective network function.

First claim

What is claimed is:

1 . A method for onboarding of network functions to a credential vault, the credential vault including a vault memory and a vault processor, the vault memory storing an authentication code at a code address thereof, the method comprising, by at least one processor:
actuating establishment of an cluster account for a network cluster; actuating a cluster configuration of the vault processor to enable authentication of the network cluster; and for each network function of a plurality of network functions associated with the network cluster:
generating an identifier for the network function,
setting values for parameters of an initialization parameter set for the network function, the initialization parameter set including a credential address in the vault memory for storage of a credential for the network function, a value of the credential address being based on the generated identifier for the network function,
actuating assignment of access permissions to the network function for the code address on the vault memory,
actuating assignment of elevated access permissions to the network function for the credential address on the vault memory, and
actuating association of the network function with the cluster account of the network cluster;
the vault memory thereby defining a plurality of credential addresses each corresponding to a respective one of the plurality of network functions, wherein the vault processor is configured to:
provide, based on receipt of a code retrieval request identifying the code address from a device having access permissions thereto, the authentication code,
store at a selected credential address, based on receipt of a credential storage request providing a credential and identifying the selected credential address from a device having elevated access permissions thereto, the provided credential, and
provide, based on receipt of a credential retrieval request identifying the selected credential address from a device having elevated access permissions thereto, the credential stored at the selected credential address.

2 . The method of claim 1 , wherein the initialization parameter set further includes an identifier for the associated cluster, an account identifier of the network function for the associated cluster, an account identifier of the network function for the credential vault, and the code address in the vault memory.

3 . The method of claim 2 , wherein the values for the account identifier of the network function for the associated cluster and the account identifier of the network function for the credential vault are based on the generated identifier for the network function.

4 . The method of claim 1 , wherein the identifier for the network function is generated based on a concatenation of values reflecting features of the network function.

5 . The method of claim 1 ,
wherein an authentication processor is configured to provide, based on receipt of a signature request including the authentication code, a signed authentication certificate, and wherein the credential includes a private key and the signed authentication certificate.

6 . The method of claim 5 ,
wherein the cluster configuration of the vault processor includes establishing access of an authentication token for the network cluster to the vault processor, and wherein the signature request further includes the authentication token for the network cluster.

7 . A non-transitory computer-readable recording medium having recorded thereon instructions executable by at least one processor to perform a method for onboarding of network functions to a credential vault, the credential vault comprising a vault memory and a vault processor, the vault memory storing an authentication code at a code address thereof, the method comprising:
actuating establishment of an cluster account for a network cluster; actuating a cluster configuration of the vault processor to enable authentication of the network cluster; and for each network function of a plurality of network functions associated with the network cluster:
generating an identifier for the network function,
setting values for parameters of an initialization parameter set for the network function, the initialization parameter set including a credential address in the vault memory for storage of a credential for the network function, a value of the credential address being based on the generated identifier for the network function,
actuating assignment of access permissions to the network function for the code address on the vault memory,
actuating assignment of elevated access permissions to the network function for the credential address on the vault memory, and
actuating association of the network function with the cluster account of the network cluster;
the vault memory thereby defining a plurality of credential addresses each corresponding to a respective one of the plurality of network functions, wherein the vault processor is configured to:
provide, based on receipt of a code retrieval request identifying the code address from a device having access permissions thereto, the authentication code,
store at a selected credential address, based on receipt of a credential storage request providing a credential and identifying the selected credential address from a device having elevated access permissions thereto, the provided credential, and
provide, based on receipt of a credential retrieval request identifying the selected credential address from a device having elevated access permissions thereto, the credential stored at the selected credential address.

8 . The recording medium of claim 7 , wherein the initialization parameter set further includes an identifier for the associated cluster, an account identifier of the network function for the associated cluster, an account identifier of the network function for the credential vault, and the code address in the vault memory.

9 . The recording medium of claim 8 , wherein the values for the account identifier of the network function for the associated cluster and the account identifier of the network function for the credential vault are based on the generated identifier for the network function.

10 . The recording medium of claim 7 , wherein the identifier for the network function is generated based on a concatenation of values reflecting features of the network function.

11 . The recording medium of claim 7 ,
wherein an authentication processor is configured to provide, based on receipt of a signature request including the authentication code, a signed authentication certificate, and wherein the credential includes a private key and the signed authentication certificate.

12 . The recording medium of claim 11 ,
wherein the cluster configuration of the vault processor includes establishing access of an authentication token for the network cluster to the vault processor, and wherein the signature request further includes the authentication token for the network cluster.

13 . A system for onboarding of network functions to a credential vault, the system comprising:
an orchestrator, comprising at least one orchestration processor; and the credential vault, comprising a vault memory and at least one vault processor, wherein the vault memory stores an authentication code at a code address thereof, wherein the at least one orchestration processor is configured to:
actuate establishment of an cluster account for a network cluster;
actuate a cluster configuration of the at least one vault processor to enable authentication of the network cluster; and
for each network function of a p

Assignees

• Rakuten Symphony Inc

Inventors

• Chopra Akashdeep
• Kumar Manish
• Madan Ashish

Classifications

• H04L9/3263

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• H04L9/3213

  using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807) · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• G06F21/44 Primary

  Program or device authentication · CPC title