PNF Registration Enhancements for Security Subcommittee Dublin Aug

PNF Registration Enhancements for Security Subcommittee Dublin Aug 23, 2018 v 1

Security Enhancements for PNFs • PNF Certificate Enrollment – Supported in Casablanca • Proposal is for PNF to perform certificate enrollment during Plug-n-Play. • PNFs generally come with vendor certificates issued by the vendor’s factory CA. PNF serial number or MAC address is often used as the identity. Operator is able to pre-provision the vendor’s factory root certificate into its CA and even pre-provision the PNF identity to authorize the PNF to request a cert. • During Pn. P, PNF performs certificate enrollment with the Operator CA if the CA info is provided. • PNF Authentication – Targeted for Dublin • Proposal is for PNF to use certificate for HTTPS authentication. • When PNF sends a VES event to DCAE VES Collector over HTTP/TLS, DCAE authenticates the connection with the TLS certificate. No HTTP username or password is required. Impacts: DCAE VES Collectors, NF Requirements. • PNF Authorization – Targeted for Dublin • Proposal is for AAF to create a role and permissions for each PNF Type at onboarding. • During Design Time, SDC publishes a YAML artifact of PNF Events to DMaa. P. AAF subscribes. AAF creates a Role and Permissions for the PNF Type for the events in the YAML file. Impacts: SDC, AAF. • During PNF Registration, SO triggers AAF to add the PNF instance to the Role created at Design Time. Impacts: SO. AAF already has an API for this. • During Run Time, when VES Collector receives an event from a PNF, VES queries AAF for the roles and permissions of this PNF in order to determine if the PNF is authorized to send the event. Impacts: DCAE VES Collectors. CADI already has an API for this. DCAE Project is assessing integrating with CADI for Casablanca.

Impacts Phase Use Case Impacted Components Design time SDC publishes a YAML artifact of PNF Events to DMaa. P. AAF subscribes. AAF creates a Role and Permissions for the PNF Type for the events in the YAML file. SDC, AAF PNF Registration SO triggers AAF to add the PNF instance to the Role created at Design Time. SO AAF has an existing API Run time Authentication VES Collector receives an event from a PNF. VES authenticates the HTTP/TLS connection using the TLS certificate. No HTTP username or password is required. Run time Authorization DCAE VES Collectors, PNF Requirements VES Collector receives an event from a PNF. VES uses the DCAE VES Collectors CADI module to query AAF for the roles and permissions of CADI has an existing API this PNF in order to determine if the PNF is authorized to send the event. NOTE: DCAE Project is assessing integrating with CADI for Casablanca. In the scenario slides that follow, the new security steps are shown in red.

PNF Registration Scenario with Security Enhancements added

Stage A: PNF and Service Modeling SDC DMaa. P SO Controller AAI DCAE AAF PNF Modeling Design Time A 1 RESOURCE DEFINITION SDC User can provide the following information about the PNF : • • • A 1 Resource Definition PNF type A 2 Service Design A 2 A 3 Artifact distribution via DMaa. P A 4 AAF creates a role for the PNF type and a set of permissions for that role A 4 RESOURCE TYPE– Type of resource; PNF in this case NAME – Name of the PNF type; e. g. gnb. Du CATEGORY – PNF category; e. g. Mobility TAGS – User-defined tags DESCRIPTION – Text description CONTACT ID – Designer of the resource VENDOR – PNF vendor; e. g. Nokia VENDOR RELEASE – Vendor release EVENTS – Monitoring event definitions SERVICE DESIGN – User can design a Service that uses a PNF type. PNF package is onboarded which moves the PNF Type into the SDC Catalog. From there, PNF Type can be used to build services. Note that this function must be added to SDC. ARTIFACTS DISTRIBUTION – When User is satisfied with the service design, User can promote the Service and the artifacts are distributed to the appropriate run time components. These artifacts include the YAML file for the events (fault, measurements, heartbeat, syslog, etc. ), Metadata and schema files to describe the VNF-specific data (FM, PM, CM). Note that this function must be added to SDC. ROLE & PERMISSION CREATION – AAF creates a role and permissions for the PNF-type. Note that these steps are the same for PNFs and VNFs.

Stage B : PNF Service Instantiation Part 1 OOF BSS / OSS SO AAI PNF Service Instantiation Part 1 A new service is requested for this PNF instance. / VID B 2 B 1 New Service B 3 Service Instantiation for PNF B 3 B 4 Homing B 4 (N/A for Casablanca) B 5 Resource level flow RLF SO triggers OOF for Homing assignment. For 5 G PNF in Casablanca, this step is not applicable and can be skipped. SO starts Resource Level Flow (RLF) for this service. SO queries AAI for an entry for this PNF ID. Alternative 1: If AAI Entry is Found B 5 Query AAI Entry for PNF Instance B 6 ALT If Found B 6 Resource Level Flow B 2 VID User or BSS/OSS system triggers Service Instantiation for PNF instance (pnf-name). Update AAI entry & continue service instantiation B 7 Alternative 2: If AAI Entry is Not Found B 7 ALT If Not Found Create AAI Entry with PNF instance in pnf-name B 8 Subscribe VES event B 9 RLF thread terminates Pending on Stage D PNF Registration event with PNF ID SO updates AAI entry with service instance and continues with the service instantiation. Inactive PNF AAI entry B 9 SO creates AAI entry with service instance for this PNF instance. SO subscribes for the PNF Ready event for this PNF instance (pnf-name). SO stops the RLF and waits for PNF Registration Handler to trigger the completion of the service instantiation.

Stage C : PNF Plug and Play Factory Software Local DHCP SEGW CA/RA PNF Plug and Play – 3 GPP TS 32. 508 This scenario is for 3 GPP Compliant PNFs like 5 G DU which follow 3 GPP TS 32. 508. Other PNF types follow other Pn. P standards. Initial EM C 1 C 2 Preplanning, Pre-provisioning HW Install C 2 C 3 C 4 C 5 C 6 DHCP Discover VLAN Scanning IPv 4/IPv 6 discovery C 3 C 4 DHCP Response PNF IP@(m)*, Initial EM IP@(m), SEGW IP@(o), CA IP@(o) IPSec Tunnel Setup (optional) C 5 C 6 Certificate Enrollment (optional) C 7 C 8 Download operational SW PNF Restart C 8 Activates SW C 9 Download operational configuration C 10 PNF Restart Activates Config C 10 Radio network planning determines where to place the 5 G PNFs and how to configure them. DHCP, SEGW, CA/RA, Initial EM must be provisioned for this PNF instance (pnf-name). Technician installs and cables HW and powers it on. PNF performs DHCP Discover procedure to determine OAM VLAN and IP version. DHCP response returns PNF IP@ and Initial EM@. May also return SEGW@ and/or CA@. PNF performs IPsec tunnel setup using X. 509 v 3 certificates for mutual authentication if SEGW IP@ is returned by DHCP. PNF performs service provider certificate enrollment via CMPv 2 to request the Service Provider certificates if CA/RA URL is returned by DHCP. PNF contacts Initial EM which determines the PNF identity and downloads operational SW that is capable of registering with ONAP. PNF resets to activate the SW. Initial EM downloads the operational configuration that has the necessary information for PNF to contact DCAE and send the registration event. PNF resets to activate the configuration. PNF is now capable of sending PNF Registration Event to DCAE.

Stage D : PNF Registration D 1 DCAE VES Collector PNF Registration DMaa. P PRH AAI DCAE authenticates the HTTP/TLS connection with a certificate. Certificate is X. 509 v 3 issued by the Service Provider CA. No HTTP username or password is needed in Dublin. HTTP/TLS D 1 Authenticate Connection D 2 HTTP/TLS D 2 PNF Registration (periodic) PNF ID, PNF IP@, Vendor Name, etc. D 3 Repeat Steps D 1 to D 5 until Stage B occurs B Publish to Reg topic D 4 Retrieve Reg event D 5 DCAE publishes the event to a DMaa. P topic. D 4 PRH retrieves the event from DMaa. P. D 5 Inventory Query B D 6 Update PNF Entry PNF sends Registration Event to DCAE. Event contains PNF instance info such as pnf-name, serial number, IP@, Vendor Name and Model Number. PNF sends the event periodically until it receives a service configuration at step E 6. D 3 PNF Service Instantiation Part 1 occurs D 7 PNF establishes a HTTP/TLS connection to the DCAE VES Collector. D 6 Publish PNF Ready event D 7 PRH queries AAI for an entry for this pnf-name. Unique pnf-name is sent as source. Name in the pnf. Registration Event Common Header. If pnfname is not found in AAI, PRH ignores the event. If pnf-name is found in AAI, and the AAI entry already has the same IP@ and other PNF information, PRH ignores the event, as it is a duplicate event. PNF Service Instantiation Part 1 occurs. If pnf-name is found in AAI, and the AAI entry is not already populated with PNF info, PRH updates AAI entry with IP@ and other PNF inventory info. PRH publishes a PNF Ready event to trigger SO to complete the service instantiation.

E 8 E 9 Stage E : PNF Activation PNF (DU) SDN-C SO Controller DMaa. P AAF PNF Activation DCAE Retrieve PNF Ready event E 1 AAI E 2 Rehydrate PNF RLF E 2 Network Assignments E 3 Update Network Assignments E 3 E 4 E 5 E 6 E 4 Network Assign Complete E 7 E 5 Trigger Role Assign E 8 E 6 E 7 SSH or TLS Role assign complete Activate Service E 9 Service Configuration Activate E 10 E 11 Update Service Configuration Service Configured E 12 E 10 E 13 E 14 E 15 E 11 Monitor Service Monitored Inform User E 12 Monitoring Info E 13 E 14 E 15 SO retrieves the PNF Ready event for this pnfname and rehydrates the RLF from Stage B to finish the service instantiation for this PNF. SO triggers SDN-C to make the necessary network assignments which may include UUID for the PNF. SDN-C updates AAI with network assignments. SDN-C notifies SO that NW assign is complete. SO triggers AAF to assign PNF instance to role. AAF assigns PNF instance to PNF-type role and notifies SO that assignment is complete. SO triggers the appropriate Controller (APP-C, SDN-R) to activate the service. Controller configures the PNF for service via Ansible/SSH, Net. Conf/SSH or Net. Conf/TLS. The service configuration is PNF specific. SSH uses public key authentication. SSH public key must be securely provisioned on the PNF stops sending Registration event and activates itself according to the service configuration from the Controller. This is PNF specific and could include SW and config update. Controller updates AAI with configuration. Controller notifies SO that service is configured. SO triggers DCAE to monitor this new service. DCAE queries AAI for information about the service and starts monitoring. DCAE notifies SO that service is monitored. SO informs service initiator (VID user or OSS/BSS) that service is active.

Stage E: VNF Run-time DCAE VES Collector PNF DCAE authenticates and authorizes the PNF instance at run-time AAF Preconditions: AAF created a role for the PNF type, assigned permissions to the role, and assigned the PNF to the role for the PNF type. CADI is integrated into DCAE VES Collector. Precondition 1: PNF has been assigned to the PNF type role Precondition 2: CADI is integrated into DCAE VES Collector E 1 PNF sends event to VES Collector E 2 E 1 VES authenticates PNF using PNF certificate E 3 CADI requests the role and permissions for the PNF E 2 E 3 E 4 AAF returns the role and permissions of the PNF E 4 E 5 DCAE checks that the event is in the permissions and accepts (or rejects) the event E 5 PNF sends an event to DCAE VES Collector; e. g. Fault, File. Ready, Hv. Meas, etc. VES Collector authenticates the PNF using the PNF certificate and standard PKI validation. VES uses integrated CADI module to request the role and permissions for the PNF from AAF returns the role and permissions of the PNF to DCAE compares the event to the permissions and either accepts or rejects the event. Note that these steps are the same for PNFs and VNFs.