Enhanced hop by hop security
Embodiments of the present disclosure relate to methods, apparatuses and computer readable storage media for hop-by-hop security. A proposed method comprises receiving, at a first apparatus and from a second apparatus associated with a first network function, a message directed from the first network function to a second network function, the message comprising a first signature and network function information, the network function information at least comprising identification information of the first network function; in accordance with a successful validation of the first signature, updating the message with a second signature specific to a service communication proxy implemented by the first apparatus; and transmitting the updated message to a third apparatus associated with the second network function, the updated message comprising at least the second signature and the network function information.
1. A first apparatus, configured to implement a service communication proxy connected to a first network function, the first apparatus comprising:
at least one processor; and
at least one memory including computer program codes;
the at least one memory and the computer program codes are configured to, with the at least one processor, cause the first apparatus to:
receive, from a second apparatus associated with the first network function, a message directed from the first network function to a second network function, the message comprising a first signature and network function information, the network function information at least comprising identification information of the first network function;
in accordance with a successful validation of the first signature, update the message with a second signature specific to the service communication proxy implemented by the first apparatus; and
transmit the updated message to a third apparatus associated with the second network function, the updated message comprising at least the second signature and the network function information,
wherein the network function information further comprises certificate information of the first network function, the second apparatus is configured to implement the first network function, and the first apparatus is caused to:
generate the second signature at least based on the first signature and a private key of the service communication proxy; and
insert the second signature into the message.
2. The apparatus of claim 1 , wherein the certificate information of the first network function comprises at least one of:
a client certificate of the first network function, or
an address which enables obtaining of a client certificate or a public key of the first network device.
3. The apparatus of claim 1 , wherein the identification information of the first network function comprises at least one of:
an instance identifier of the first network function,
a set identifier of the first network function, or
Fully Qualified Domain Name of the first network function.
4. The apparatus of claim 1 , wherein the first network function is a network function service consumer and the second network function is a network function service producer.
5. A first apparatus,
configured to implement a service communication proxy connected to a first network function, the first apparatus comprising:
at least one processor; and
at least one memory including computer program codes;
the at least one memory and the computer program codes are configured to, with the at least one processor, cause the first apparatus to:
receive, from a second apparatus associated with the first network function, a message directed from the first network function to a second network function, the message comprising a first signature and network function information, the network function information at least comprising identification information of the first network function;
in accordance with a successful validation of the first signature, update the message with a second signature specific to the service communication proxy implemented by the first apparatus; and
transmit the updated message to a third apparatus associated with the second network function, the updated message comprising at least the second signature and the network function information,
wherein the second apparatus is configured to implement the first network function, and the first apparatus is further caused to:
insert certificate information of the first network function into the message as part of the network function information;
generate the second signature at least based on the first signature and a private key of the service communication proxy; and
insert the second signature into the message.
6. The apparatus of claim 5 , wherein the network function information further comprises at least one of:
type information of the first network function, or
temporal information concerning transmission of the message.
7. The apparatus of claim 5 , wherein the identification information of the first network function comprises at least one of:
an instance identifier of the first network function,
a set identifier of the first network function, or
Fully Qualified Domain Name of the first network function.
8. The apparatus of claim 5 , wherein the first network function is a network function service consumer and the second network function is a network function service producer.
9. A first apparatus, configured to implement a service communication proxy connected to a first network function, the first apparatus comprising:
at least one processor; and
at least one memory including computer program codes;
the at least one memory and the computer program codes are configured to, with the at least one processor, cause the first apparatus to:
receive, from a second apparatus associated with the first network function, a message directed from the first network function to a second network function, the message comprising a first signature and network function information, the network function information at least comprising identification information of the first network function;
in accordance with a successful validation of the first signature, update the message with a second signature specific to the service communication proxy implemented by the first apparatus; and
transmit the updated message to a third apparatus associated with the second network function, the updated message comprising at least the second signature and the network function information,
wherein the network function information further comprises certificate information of the first network function, the second apparatus is configured to implement a further service communication proxy connected to the first network function, and the first apparatus is caused to:
generate the second signature at least based on the first signature and a private key of the service communication proxy; and
replace the first signature in the message with the second signature.
10. The apparatus of claim 9 , wherein the message further comprises a third signature specific to the first network function, and wherein the third apparatus is configured to implement the second network function.
11. The apparatus of claim 9 , wherein the identification information of the first network function comprises at least one of:
an instance identifier of the first network function,
a set identifier of the first network function, or
Fully Qualified Domain Name of the first network function.
12. The apparatus of claim 9 , wherein the first network function is a network function service consumer and the second network function is a network function service producer.
13. A second apparatus configured to implement a first network function, the second apparatus comprising:
at least one processor; and
at least one memory including computer program codes;
the at least one memory and the computer program codes are configured to, with the at least one processor, cause the second apparatus to:
generate a signature based on network function information, the network function information at least comprising identification information of the first network function, the signature specific to the first network function implemented by the second apparatus;
generate a message directed from the first network function to a second network function, the message comprising the signature and the network function information; and
transmit the message to a first apparatus, the first apparatus configured to implement a service communication proxy connected to the first network function, wherein the network function information further comprises at least one of:
certificate information of the first network function,
type information of the first network function, or
temporal information concerning transmission of the message, and
wherein the certificate information of the first network function comprises at least one of:
a client certificate of the first network function, or
an address which enables obtaining of a client certificate or a public key of the first network device.
14. The apparatus of claim 13 , wherein the identification information of the first network function comprises at least one of:
an instance identifier of the first network function,
a set identifier of the first network function, or
Fully Qualified Domain Name of the first network function.
15. The apparatus of claim 13 , wherein the first network function is a network function service consumer and the second network function is a network function service producer.
16. A method comprising:
generating, at a second apparatus configured to implement a first network function, a signature based on network function information, the network function information at least comprising identification information of the first network function, the signature specific to the first network function implemented by the second apparatus;
generating a message directed from the first network function to a second network function, the message comprising the signature and the network function information; and
transmitting the message to a first apparatus, the first apparatus configured to implement a service communication proxy connected to the first network function,
wherein the network function information further comprises at least one of:
certificate information of the first network function,
type information of the first network function, or
temporal information concerning transmission of the message, and
wherein the certificate information of the first network function comprises at least one of:
a client certificate of the first network function, or
an address which enables obtaining of a client certificate or a public key of the first network device.
17. The method of claim 16 , wherein the identification information of the first network function comprises at least one of:
an instance identifier of the first network function,
a set identifier of the first network function, or
Fully Qualified Domain Name of the first network function.
18. A first apparatus, configured to implement a service communication proxy connected to a first network function, the first apparatus comprising:
at least one processor; and
at least one memory including computer program codes;
the at least one memory and the computer program codes are configured to, with the at least one processor, cause the first apparatus to:
receive, from a second apparatus associated with the first network function, a message directed from the first network function to a second network function, the message comprising a first signature and network function information, the network function information at least comprising identification information of the first network function;
in accordance with a successful validation of the first signature, update the message with a second signature specific to the service communication proxy implemented by the first apparatus;
transmit the updated message to a third apparatus associated with the second network function, the updated message comprising at least the second signature and the network function information; and,
perform mutual authentication with the second apparatus associated with the first network function and with the third apparatus associated with the second network function.
19. A second apparatus configured to implement a first network function, the second apparatus comprising:
at least one processor; and
at least one memory including computer program codes;
the at least one memory and the computer program codes are configured to, with the at least one processor, cause the second apparatus to:
generate a signature based on network function information, the network function information at least comprising identification information of the first network function, the signature specific to the first network function implemented by the second apparatus;
generate a message directed from the first network function to a second network function, the message comprising the signature and the network function information;
transmit the message to a first apparatus, the first apparatus configured to implement a service communication proxy connected to the first network function; and,
perform mutual authentication with the service communication proxy connected to the first network function.