Proxy certificate management for NFV environment (PCS)

1 . A management node, comprising:

processing circuitry configured to:

receive an origin certificate that is signed by a Certification Authority and associated with a virtual network function deployer, the received origin certificate being for a first service type provided by the virtual network function deployer and being associated with a public key and a private key;

receive a certificate request for a first instance of the first service type;

generate a first proxy certificate derived from the received origin certificate where the received origin certificate is part of the first proxy certificate's chain of trust; and

cause transmission of the first proxy certificate and the public key of the received origin certificate to a first virtual network function component, the public key of the received origin certificate being for inclusion to a listing of trusted certificates at the first virtual network function component.

2 . The management node of claim 1 , wherein the first proxy certificate is configured for use in establishing encrypted communication with at least one other virtual network function component.

3 . The management node of claim 1 , wherein the processing circuitry is further configured to:

receive a certificate request for a second instance of the first service type;

generate a second proxy certificate derived from the received origin certificate where the received origin certificate is part of the second proxy certificate's chain of trust, the second proxy certificate being different from the first proxy certificate; and

cause transmission of the second proxy certificate and public key of the received origin certificate to a second virtual network function component to enable encrypted communication between the first virtual network function component and the second virtual network function component.

4 . The management node of claim 1 , wherein the public key of the received origin certificate is for inclusion to a listing of trusted certificates at the second virtual network function component.

5 . The management node of claim 1 , wherein the processing circuitry is further configured to:

receive an indication that the received origin certificate has been revoked; and

cause removal of the received origin certificate from at least the listing of trusted certificates at the first virtual network function component based at least on the indication.

6 . The management node of claim 1 , wherein the processing circuitry is configured to receive an indication that the received origin certificate has been revoked, the revocation of the received origin certificate being configured to revoke at least the first proxy certificate that has the received origin certificate as part of its chain of trust.

7 . The management node of claim 5 , wherein the revocation of the received origin certificate corresponds to discarding any service instances of the first service type.

8 . The management node of claim 1 , wherein the received origin certificate is issued by the Certification Authority.

9 . The management node of claim 1 , wherein the received origin certificate is not configured for use with any service instance of a service type other than the first service type.

10 . The management node of claim 1 , wherein the received origin certificate is associated with a plurality of access rights; and

the first proxy certificate being associated with a subset of the plurality of access rights.

11 . A method implemented by a management node, the method comprising:

receiving an origin certificate that is signed by a Certification Authority and associated with a virtual network function deployer, the received origin certificate being for a first service type provided by the virtual network function deployer and being associated with a public key and a private key;

receiving a certificate request for a first instance of the first service type;

generating a first proxy certificate derived from the received origin certificate where the received origin certificate is part of the first proxy certificate's chain of trust; and

transmitting the first proxy certificate and the public key of the received origin certificate to a first virtual network function component, the public key of the received origin certificate being for inclusion to a listing of trusted certificates at the first virtual network function component.

12 . The method of claim 11 , wherein the first proxy certificate is configured for use in establishing encrypted communication with at least one other virtual network function component.

13 . The method of claim 11 , further comprising:

receiving a certificate request for a second instance of the first service type;

generating a second proxy certificate derived from the received origin certificate where the received origin certificate is part of the second proxy certificate's chain of trust, the second proxy certificate being different from the first proxy certificate; and

transmitting the second proxy certificate and public key of the received origin certificate to a second virtual network function component to enable encrypted communication between the first virtual network function component and the second virtual network function component.

14 . The method of claim 11 , wherein the public key of the received origin certificate is for inclusion to a listing of trusted certificates at the second virtual network function component.

15 . The method of claim 11 , further comprising:

receiving an indication that the received origin certificate has been revoked; and

causing removal of the received origin certificate from at least the listing of trusted certificates at the first virtual network function component based at least on the indication.

16 . The method of claim 11 , further comprising receiving an indication that the received origin certificate has been revoked, the revocation of the received origin certificate being configured to revoke at least the first proxy certificate that has the received origin certificate as part of its chain of trust.

17 . The method of claim 15 , wherein the revocation of the received origin certificate corresponds to discarding any service instances of the first service type.

18 . The method of claim 11 , wherein the received origin certificate is issued by the Certification Authority.

19 . The method of claim 11 , wherein the received origin certificate is not configured for use with any service instance of a service type other than the first service type.

20 . The method of claim 11 , wherein the received origin certificate is associated with a plurality of access rights; and

the first proxy certificate being associated with a subset of the plurality of access rights.