SBA Gateway Security

SBA Gateway supports TLS Mutual Authentication.

TLS Mutual Authentication

When TLS Mutual Authentication is enabled, a secure private root key is used to sign certificates used by the NF producers and consumers. The root public certificate is pre-installed on all NF instances. If TLS mAuth is enabled, SBA Gateway only allows an incoming connection if it receives a certificate that it can validate against the root certificate. Figure 1 shows TLS mAuth exchange in a sample public key infrastructure (PKI) deployment.

Figure 1. Example Public Key Infrastructure (PKI)
A secure private root key is used to sign certificates used by the NF producers and consumers
The following example shows how to enable TLS security:
# Transport Layer Security (TLS) such as HTTP / SSL
    tls:
      # Interface on which to listen for incoming secure connections
      host: 0.0.0.0
      # Secure port
      port: 9099
      # Key store containing signed Network Function certificate.
      # NOTE: SBA will look for this path on the filesystem first. If it is not found it will search the classpath.
      keystore:
        type: JKS
        path: /keystore/keystore.jks
        password: password
      # Trust store containing Root Certificate.
      truststore:
        type: JKS
        path: /keystore/truststore.jks
        password: password

      # Is TLS Mutual Auth Authentication enabled
      mutualAuth:
        enabled: true

      # Should all TLS certificates be trusted? (insecure - for testing only)
      insecure: false

The network functions (for example, CHF) ship with default keystores. They are placed in the /opt/mtx/conf directory in the Docker container.