Cloud-native application platforms and latency-sensitive systems such as 5G Core networks rely heavily on certificate-based Public Key Infrastructure (PKI) and mutual TLS to secure service-to-service communication. While effective, this model introduces significant operational and performance overhead, which is further amplified in the post-quantum setting due to large certificates and expensive signature verification. In this paper, we present a certificate-free authentication framework for private distributed systems based on post-quantum Identity-Based Encryption(IBE). Our design replaces certificate and signature based authentication with identity-derived keys and identity-based key encapsulation, enabling mutually authenticated TLS connections without certificate transmission or validation. We describe an IBE-based replacement for private PKI, including identity lifecycle management, and show how it can be instantiated using a threshold Private Key Generator (T-PKG). We apply this framework to cloud-native application deployments and latency-sensitive 5G Core networks. In particular, we demonstrate how identity-based TLS integrates with the 5G Service-Based Architecture while preserving security semantics and 3GPP requirements, and we show how the same architecture can replace private PKI in Kubernetes, including its control plane, without disrupting existing trust domains or deployment models.

翻译：云原生应用平台与5G核心网等时延敏感系统高度依赖基于证书的公钥基础设施（PKI）和双向TLS来保障服务间通信安全。尽管该模型行之有效，但其引入了显著的操作与性能开销，而在后量子环境下，由于证书体积庞大和签名验证成本高昂，这一开销被进一步放大。本文提出一种基于后量子身份基加密（IBE）的私有分布式系统免证书认证框架。我们的设计采用身份派生密钥与基于身份的密钥封装机制，取代了基于证书和签名的认证方式，从而在无需证书传输或验证的情况下实现双向认证的TLS连接。我们描述了一种基于IBE的私有PKI替代方案，涵盖身份生命周期管理，并展示了如何通过门限私钥生成器（T-PKG）实现该方案。我们将此框架应用于云原生应用部署和时延敏感的5G核心网络。具体而言，我们论证了身份基TLS如何在与5G服务化架构集成时保持安全语义并满足3GPP要求，同时展示了同一架构可在不破坏现有信任域或部署模型的前提下，替代Kubernetes（包括其控制平面）中的私有PKI。