5G-WAVE: A Core Network Framework with Decentralized Authorization for Network Slices

Pragya Sharma,Tolga Atalay,Hans-Andrew Gibbs,Dragoslav Stojadinovic,Angelos Stavrou,Haining Wang

2024-04-20

Abstract:5G mobile networks leverage Network Function Virtualization (NFV) to offer services in the form of network slices. Each network slice is a logically isolated fragment constructed by service chaining a set of Virtual Network Functions (VNFs). The Network Repository Function (NRF) acts as a central OpenAuthorization (OAuth) 2.0 server to secure inter-VNF communications resulting in a single point of failure. Thus, we propose 5G-WAVE, a decentralized authorization framework for the 5G core by leveraging the WAVE framework and integrating it into the OpenAirInterface (OAI) 5G core. Our design relies on Side-Car Proxies (SCPs) deployed alongside individual VNFs, allowing point-to-point authorization. Each SCP acts as a WAVE engine to create entities and attestations and verify incoming service requests. We measure the authorization latency overhead for VNF registration, 5G Authentication and Key Agreement (AKA), and data session setup and observe that WAVE verification introduces 155ms overhead to HTTP transactions for decentralizing authorization. Additionally, we evaluate the scalability of 5G-WAVE by instantiating more network slices to observe 1.4x increase in latency with 10x growth in network size. We also discuss how 5G-WAVE can significantly reduce the 5G attack surface without using OAuth 2.0 while addressing several key issues of 5G standardization.

Networking and Internet Architecture

What problem does this paper attempt to address?

### Problems Addressed by the Paper

The paper primarily addresses the security and authorization issues faced by network slicing in 5G networks. Specifically:

1. **Centralized Authorization Issue**:
- In the current 5G network, the Network Repository Function (NRF) acts as a centralized OAuth 2.0 server to manage communication authorization between various Virtual Network Functions (VNF), leading to a Single Point of Failure (SPOF) problem.

2. **Performance Bottleneck**:
- In a distributed microservices architecture, relying on a centralized authorization mechanism can cause performance bottlenecks in the control plane signaling.

3. **Enhanced Security**:
- Although the existing 3GPP standardization process defines NRF as an OAuth 2.0 server, this approach has certain security risks, such as the issuance of malicious tokens or tampering with service contracts.

To address the above issues, the paper proposes a new framework called 5G-WAVE, which implements a decentralized authorization mechanism to achieve mutual authorization between VNFs within a network slice, thereby reducing dependence on a centralized server and improving the overall security and flexibility of the system. Additionally, the paper evaluates the performance overhead of 5G-WAVE in actual deployment, finding that the introduced authorization delay is 155 milliseconds, and with the growth of the network scale, the authorization delay increases by 1.4 times.

Through these improvements, 5G-WAVE not only addresses the security vulnerabilities in existing 5G networks but also enhances the system's scalability and security.