Methods, systems, and computer readable media for automatic key management of network function (NF) repository function (NRF) access token public keys for 5G core (5GC) authorization to mitigate security attacks

A system for automatic key management of network access token public keys for 5G core (5GC) to mitigate security attacks, the system comprising:

• a network function (NF) repository function (NRF) including at least one processor and a memory;
• a network access token public key database located in the memory and including at least one public key for use by producer NFs in validating network access tokens presented in service requests from consumer NFs, wherein the at least one public key comprises at least one public key of the NRF that corresponds to at least one private key of the NRF used by the NRF to digitally sign portions of the network access tokens;
• and
• an automatic access token key manager implemented by the at least one processor for maintaining the network access token public key database, providing, to the producer NFs, a network access token public key status notification subscription interface for allowing the producer NFs to subscribe to receive notification of updates in status of the at least one public key, receiving, via the network access token public key status notification subscription interface, a request from a producer NF to be notified of updates in status of the at least one public key, and, in response, creating a subscription for the producer NF, determining that an update in status of the at least one public key is needed, and in response to determining that the update in status of the at least one public key is needed:
• updating the status of the at least one public key;
• identifying, from the subscription, that the producer NF is subscribed to receive notification of updates in status of the at least one public key;
• and notifying the producer NF of the update in status of the at least one public key, wherein updating the status of the at least one public key includes revoking the at least one public key and notifying the producer NF of the change in status includes sending a message to the producer NF indicating that the at least one public key is no longer valid and replacing the at least one public key with at least one replacement public key.

A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer control the computer to perform steps comprising:

• maintaining, in the non-transitory computer readable medium, a network access token public key database including at least one public key for use by producer network functions (NFs) in validating network access tokens presented in service requests from consumer NFs, wherein the at least one public key comprises at least one public key of the NRF that corresponds to at least one private key of the NRF used by the NRF to digitally sign portions of the network access tokens;
• providing, to the producer NFs, a network access token public key status notification subscription interface for allowing the producer NFs to subscribe to receive notification of updates in status of the at least one public;
• receiving, via the network access token public key status notification subscription interface, a request from a producer NF to be notified of updates in status of the at least one public key, and, in response, creating a subscription for the producer NF;
• determining that an update in status of the at least one public key is needed;
• in response to determining that the update in status of the at least one public key is needed:
• updating the status of the at least one public key, wherein updating the status of the at least one public key includes revoking the at least one public key;
• identifying, from the subscription, that the producer NF is subscribed to receive notification of updates in status of the at least one public key;
• and
• notifying the producer NF of the update in status of the at least one public key, wherein notifying the producer NF of the change in status includes sending a message to the producer NF indicating that the at least one public key is no longer valid and replacing the at least one public key with at least one replacement public key.