X.509 Certificate Extension for 5G Network Function Types
Extracted elements (18)
The NFType uses the IA5String type rather than PrintableString to permit inclusion of the underscore character ('_'), which appears in several 3GPP-defined NF Type strings and is not part of the PrintableString character set.
The NFTypes extension supports role-based access control decisions, complementing the identity-based access control already provided by the certificate subject and SubjectAltName extension. This distinction enables 5G operators to enforce access policies based on the functional role of a network function rather than only its identity.
There are 56 NF Types defined for 3GPP Release 17, identified by short ASCII strings and listed in Table 6.1.6.3.3-1 of TS29.510. The NFType string set is not exhaustive and operators MAY assign their own NF Types for use in their own network.
Each NFType MUST contain at least one ASCII character and MUST NOT contain more than 32 ASCII characters.
Each NFType MUST contain only an ASCII string and MUST NOT include control characters (values 0–31), the space character (value 32), or the delete character (value 127).
If the NFTypes contain more than one NFType, the NFTypes MUST appear in ascending lexicographic order using the ASCII values.
The NFTypes certificate extension MUST be identified by OID id-pe-nftype: { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) id-pe(1) 34 }.
The NFTypes certificate extension MUST NOT be marked critical.
The NFTypes extension MUST have the syntax: NFTypes ::= SEQUENCE SIZE (1..MAX) OF NFType, where NFType ::= IA5String (SIZE (1..32)).
The NFTypes MUST contain at least one NFType.
The NFTypes MUST NOT contain the same NFType more than once (no duplicates allowed).
In protocols such as TLS 1.2 where certificates are exchanged in the clear, inclusion of the NFTypes extension can help an observer determine which 5G network function systems are of most interest. TLS 1.3 encrypts certificates, mitigating this exposure.
The NFTypes certificate extension provides a list of NF Types associated with the certificate subject, enabling role-based access control decisions in 5G Systems. It is included in X.509 v3 public key certificates as profiled in RFC 5280.
IANA has assigned an OID for the ASN.1 module identifier (id-mod-nftype(106)) in the 'SMI Security for PKIX Module Identifier' registry (1.3.6.1.5.5.7.0).
IANA has assigned OID 1.3.6.1.5.5.7.1.34 for the NFTypes certificate extension in the 'SMI Security for PKIX Certificate Extension' registry.
An operator-assigned NF Type MUST NOT overlap with a value already defined in the commonly defined 3GPP set. Use of the same ASCII string by two different operators for different roles could lead to confusion or incorrect access control decisions.
Different levels of confidence in NFType assignment may be required depending on the access control context (e.g., protecting a scarce resource vs. filtering policies), and different operators may have different trust models for the NFTypes certificate extension.
NFTypes is encoded as a DER SEQUENCE SIZE (1..MAX) of NFType elements, each encoded as an IA5String of SIZE (1..32). The OID for the extension is 1.3.6.1.5.5.7.1.34, and the extension value is wrapped in an OCTET STRING.