Method, system, and computer-readable medium for single-use authenticated messages - Patents.com

Abstract

A method for creating a single-use authentication message includes creating a message hash of at least a subset of a request message at a consumer network function of a core network of a communications network, the method including appending the message hash to a Client Credential Assertion (CCA) token for the consumer network function at the consumer network function, and sending the request message with the CCA token from the consumer network function to a producer network function.

Description

[Technical field]

[0001] Priority claim This application claims the benefit of priority to U.S. Patent Application No. 17 / 314,382, filed May 7, 2021, the disclosure of which is incorporated herein by reference in its entirety.

[0002] Technical Field The subject matter described herein relates to secure communications within a communication network. More particularly, the subject matter described herein relates to a method, system, and computer-readable medium for single-use authentication messages. [Background technology]

[0003] background In fifth-generation (5G) communication networks, a network node that provides a service is called a producer Network Function (NF). A network node that consumes a service is called a consumer NF. A network function can be both a producer NF and a consumer NF, depending on whether it consumes or provides a service.

[0004] A given producer NF may have many service endpoints, where a service endpoint is a point of contact for one or more NF instances hosted by the producer NF. A service endpoint is identified by an Internet Protocol (IP) address and port number combination, or a fully qualified domain name that resolves to an IP address and port number on the network node hosting the producer NF. An NF instance is an instance of a producer NF that provides a service. A given producer NF may contain multiple NF instances. It is also important to note that multiple NF instances can share the same service endpoint.

[0005] Producer NFs register with a Network Function Repository Function (NRF). The NRF maintains service profiles of available NF instances that identify the services that each NF instance supports. Consumer NFs can subscribe to receive information about producer NF instances that have registered with the NRF. In addition to consumer NFs, another type of network node that can subscribe to receive information about NF service instances is the Service Communication Proxy (SCP). SCPs subscribe to the NRF to obtain reachability and service profile information about producer NF service instances. Consumer NFs connect to the Service Communication Proxy, which load balances traffic between producer NF service instances offering the required service or routes traffic directly to the destination producer NF instance.

[0006] The 3rd Generation Partnership Project (3GPP) has proposed using the 3gpp-Sbi-Client-Credentials header (CCA: Client Credentials Assertion) for client authentication in certain circumstances. One problem with using CCA is that this process does not provide protection against stolen CCA tokens. For example, a hacker with access to a stolen CCA could use the stolen CCA to invoke another SBI request in the network.

[0007] In view of these and other difficulties, a need exists for methods, systems, and computer-readable media for single-use authenticated messages. Summary of the Invention

[0008] overview A method for creating a single-use authentication message includes creating a message hash of at least a subset of a request message at a consumer network function of a core network of a communications network, the method including appending the message hash to a Client Credential Assertion (CCA) token for the consumer network function at the consumer network function, and sending the request message with the CCA token from the consumer network function to a producer network function.

[0009] According to another aspect of the subject matter described herein, the method includes, at the producer network function, verifying that the CCA token is signed and unexpired, verifying that a hash of the received request message matches a message hash of the CCA token, and sending a response to the consumer network function.

[0010] According to another aspect of the subject matter described herein, the method includes verifying, at a proxy between a consumer network function and a producer network function, that a hash of a received request message matches a message hash of a CCA token, and forwarding the request message to the producer network function in response to verifying that the hash of the received request message matches the message hash of the CCA token.

[0011] According to another aspect of the subject matter described in this specification, the method includes verifying, at the producer network function, that the CCA token is signed and unexpired, and sending a response to the consumer network function.

[0012] According to another aspect of the subject matter described in this specification, creating the message hash includes using one or more portions of the request message that are designated as not to be modified by proxies in the communication network.

[0013] According to another aspect of the subject matter described herein, the one or more portions of the request message that are designated not to be modified by a proxy of the communication network include an authority header of the request message.

[0014] In accordance with another aspect of the subject matter described herein, the method includes enabling or disabling single-use authentication messages on a per-interface basis for a plurality of different interfaces of a network core.

[0015] According to another aspect of the subject matter described herein, the network core is a 5G network core.

[0016] According to another aspect of the subject matter described herein, the CCA token includes multiple fields including a network function instance identifier, an issue timestamp, an expiration time, and a message hash.

[0017] According to another aspect of the subject matter described herein, the request message is a public land mobile network (PLMN) message destined for a different PLMN that is configured for mutual authentication.

[0018] According to another aspect of the subject matter described herein, a system for creating a single-use authentication message includes at least one processor and a memory, the system further including a consumer network function of a core network of the communication network, the consumer network function being configured to: create a message hash of at least a subset of the request message, add the message hash to a CCA token of the consumer network function, and send the request message together with the CCA token to a producer network function, the consumer network function being implemented by the at least one processor.

[0019] According to another aspect of the subject matter described in this specification, the producer network function is configured to verify that the CCA token is signed and unexpired, verify that a hash of the received request message matches the message hash of the CCA token, and send a response to the consumer network function.

[0020] According to another aspect of the subject matter described herein, the system includes a proxy between a consumer network function and a producer network function, the proxy configured to verify that a hash of a received request message matches a message hash of a CCA token and, in response to verifying that the hash of the received request message matches the message hash of the CCA token, forward the request message to the producer network function.

[0021] According to another aspect of the subject matter described herein, the producer network function is configured to verify that the CCA token is signed and has not expired, and send a response to the consumer network function.

[0022] According to another aspect of the subject matter described in this specification, creating the message hash includes using one or more portions of the request message that are designated as not to be altered by proxies in the communication network.

[0023] According to another aspect of the subject matter described herein, the one or more portions of the request message that are designated not to be modified by a proxy of the communication network include an authority header of the request message.

[0024] In accordance with another aspect of the subject matter described herein, a consumer network function is configured to enable or disable single-use authentication messages on a per-interface basis for a number of different interfaces of a network core.

[0025] According to another aspect of the subject matter described herein, the network core is a 5G network core.

[0026] According to another aspect of the subject matter described herein, the CCA token includes multiple fields including a network function instance identifier, an issue timestamp, an expiration time, and a message hash.

[0027] According to another aspect of the subject matter described herein, the request message is a public land mobile network (PLMN) message destined for a different PLMN that is configured for mutual authentication.

[0028] According to another aspect of the subject matter described herein, a non-transitory computer-readable medium having stored thereon executable instructions that, when executed by a processor of a computer, control the computer to perform steps including creating, at a consumer network function of a core network of a communications network, a message hash of at least a subset of the request message, adding, at the consumer network function, the message hash to a CCA token of the consumer network function, and transmitting, from the consumer network function, the request message together with the CCA token to a producer network function.

[0029] The subject matter described herein can be implemented in software in combination with hardware and / or firmware. For example, the subject matter described herein can be implemented in software executed by a processor. According to one exemplary embodiment, the subject matter described herein can be implemented using a computer-readable medium having computer-executable instructions stored thereon that, when executed by a processor of a computer, control the computer to perform steps.

[0030] Examples of computer-readable media suitable for implementing the subject matter described herein include non-transitory devices such as disk memory devices, chip memory devices, programmable logic devices, and application specific integrated circuits. Furthermore, a computer-readable medium implementing the subject matter described herein may be located on a single device or computing platform or may be distributed across multiple devices or computing platforms.

[0031] The subject matter described herein will now be described with reference to the accompanying drawings. [Brief description of the drawings]

[0032] [Figure 1] FIG. 1 is a block diagram illustrating an example of a 5G system network architecture. [Diagram 2] FIG. 1 is a message flow diagram illustrating an example scenario in which a hacker successfully exploits a stolen CCA token. [Diagram 3] A message flow diagram illustrating an example scenario where the use of a single-use CCA is successful in preventing the misuse of a stolen CCA in a producer network function. [Figure 4] A message flow diagram illustrating an example scenario where the use of single-use CCA is successful in preventing the misuse of a stolen CCA token in a proxy function. [Figure 5A] FIG. 2 illustrates an example of single-use CCA in encoded and decoded formats. [Figure 5B] FIG. 1 is a flow diagram illustrating an example of a method for creating a message hash. [Figure 6] FIG. 1 is a flow diagram illustrating an example of a method for creating a single-use authentication message. [Figure 7] FIG. 1 is a flow diagram illustrating an example of a method for receiving a single-use authentication message. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0033] Detailed Description The subject matter described herein relates to methods, systems, and computer-readable media for single-use authentication messages.

[0034] In a 5G communication network, a network node that provides a service is called a producer Network Function (NF). A network node that consumes a service is called a consumer NF. A network function can be both a producer NF and a consumer NF depending on whether it consumes or provides a service. An NF instance is an instance of a producer NF that provides a service. A given producer NF may include multiple NF instances.

[0035] 3GPP proposes using the 3gpp-Sbi-Client-Credentials header (CCA: Client Credentials Assertion) for client authentication in certain circumstances. One problem with using CCA is that this process does not provide any protection against stolen CCA tokens. For example, a hacker with access to a stolen CCA could use the stolen CCA to invoke another SBI request in the network.

[0036] The existing expiration field in the CCA does not provide complete protection against token theft attacks. Rather, the existing expiration field makes the attack more difficult by requiring a hacker to invoke another SBI request before the CCA expires. Reducing the expiration time does not provide complete protection against abuse.

[0037] Furthermore, not all SBI APIs are equal in terms of security and performance. Some SBI APIs, for example NRF deregistration, require high security, while others can choose performance over security. It can be useful to allow network functions to make tradeoffs between security and performance.

[0038] Described herein are methods and systems for creating and using single-use CCA tokens in a core network of a communications network. The use of single-use CCA tokens can prevent a hacker from using a stolen CCA to invoke another SBI request within the network.

[0039] Figure 1 is a block diagram illustrating an example of a 5G system network architecture. The architecture of Figure 1 includes an NRF 100 and an SCP 101, which may be located in the same Home Public Land Mobile Network (HPLMN). The NRF 100 may maintain a profile of available producer NF service instances and their supported services, allowing consumer NFs or SCPs to subscribe and be notified of new / updated producer NF service instance registrations.

[0040] The SCP 101 may also support service discovery and service selection of producer NF instances. The SCP 101 may perform load balancing of connections between consumer NFs and producer NFs. Additionally, using the methodologies described herein, the SCP 101 may perform selection and routing based on preferred NF locations.

[0041] The NRF 100 is a repository of NFs or service profiles of producer NF instances. To communicate with a producer NF instance, a consumer NF or SCP needs to obtain the NF or service profile, or the producer NF instance, from the NRF 100. The NF or service profile is a JavaScript Object Notation (JSON) data structure defined in 3GPP Technical Specification (TS) 29.510.

[0042] 1, any of the nodes (other than the NRF 100) may be either a consumer NF or a producer NF, depending on whether it is requesting or providing a service. In the illustrated example, the nodes include a Policy Control Function (PCF) 102 that performs policy-related operations within the network, a User Data Management (UDM) Function 104 that manages user data, and an Application Function (AF) 106 that provides application services.

[0043] 1 further includes a Session Management Function (SMF) 108 that manages sessions between an Access and Mobility Management Function (AMF) 110 and the PCF 102. The AMF 110 performs mobility management operations similar to those performed by a Mobility Management Entity (MME) in 4G networks. An Authentication Server Function (AUSF) 112 performs authentication services for User Equipments (UEs), such as User Equipment (UE) 114, seeking access to the network.

[0044] The Network Slice Selection Function (NSSF) 116 provides network slice services for devices that want to access specific network capabilities and network characteristics associated with a network slice. The Network Discovery Function (NEF) 118 provides an Application Programming Interface (API) for application functions that want to obtain information about Internet of Things (IoT) devices and other UEs connected to the network. The NEF 118 performs functions similar to the Service Capability Discovery Function (SCEF) in 4G networks.

[0045] The Radio Access Network (RAN) 120 connects the User Equipment (UE) 114 to the network via wireless links. The Radio Access Network 120 may be accessed using a gNode B (gNB) (not shown in FIG. 1) or other wireless access points. The User Plane Function (UPF) 122 may support various proxy functions for user plane services. One example of such a proxy function is a Multipath Transmission Control Protocol (MPTCP) proxy function.

[0046] The UPF 122 may also support a performance measurement function that the UE 114 may use to obtain network performance measurements. Also shown in Figure 1 is a data network (DN) 124 through which the UE accesses data network services, such as Internet services.

[0047] The SEPP 126 filters incoming traffic from another PLMN and performs topology hiding for traffic egressing from the home PLMN. The SEPP 126 may communicate with a SEPP of a foreign PLMN that manages security for the foreign PLMN. Thus, traffic between NFs in different PLMNs may pass through two SEPP functions, one for the home PLMN and one for the foreign PLMN.

[0048] Sections 13.3.1.2 and 13.3.2.2 of 3GPP Technical Specification 33501 propose using CCA for indirect communication for NF-to-NRF and NF-to-NF communication.

[0049] Section 13.3.8.2 of 3GPP Technical Specification 33501 suggests that a CCA token include:

[0050] NF instance ID of the NF service user (subject) timestamp (iat) and expiry time (exp), and The NF type of the expected audience, i.e. type "NRF", "NF Service Producer" The NF service consumer is configured to digitally sign the generated CCA based on its private key as described in RFC 7515. The signed CCA shall contain one of the following fields:

[0051] · X.509URL (x5u) to reference the X.509 public certificate for validating the CCA.

[0052] · The X.509 certificate chain (x5c) contains the X.509 public certificate for validating the CCA.

[0053] Section 5.2.3.2.11 of TS29.500 describes 3gpp-Sbi-Client-Credentials, which has the following attributes:

[0054] [Table 1]

[0055] For example, a sample CCA payload can be expressed as follows: { “sub”:“NFInstanceIDXXX” “aud”:“NRF” “iat”:1616239022 "exp":1616339022 } The fields of the CCA payload include:

[0056] [Table 2]

[0057] One problem with using CCA is that the process offers no protection against stolen CCA tokens: for example, a hacker with access to a stolen CCA could use the stolen CCA to invoke another SBI request in the network.

[0058] The existing expiration field in the CCA does not provide complete protection against token theft attacks. Rather, the existing expiration field makes the attack more difficult by requiring a hacker to invoke another SBI request before the CCA expires. Reducing the expiration time does not provide complete protection against abuse.

[0059] To prevent this type of abuse, one or more network functions can be configured to use single-use CCAs. A single-use CCA is single-use in the sense that it can only be used to authenticate a single message. To create and use a single-use CCA, the system can be configured as follows:

[0060] · Create a CCA that can only be used once, so that even if the CCA token is stolen, it cannot be misused.

[0061] To ensure that the CCA can only be used once, add the SBI message (HTTP headers + body) hash to the CCA.

[0062] All attributes of the header or body that are allowed to be modified by the proxy SHALL be excluded when generating the hash.

[0063] For example, the Authority header should not be part of the SBI message hash since it may be updated by the SCP due to alternative routing.

[0064] · Adding the SBI message hash to the CCA ensures that the CCA can only be used once for a given SBI message.

[0065] · Validation of single-use CCA can be done either at the SCP or at the producer NF, depending on the operator's policy.

[0066] CCA can be enabled or disabled based on service-based interfaces. For example, an operator can choose to enable CCA for NF management service APIs that require high security, but disable it for other APIs.

[0067] Figure 2 is a message flow diagram illustrating an example scenario 200 where a hacker successfully exploits a stolen CCA token. Shown in Figure 2 are an example consumer network function 202, an example proxy (SCP) 204, and an example producer network function 206. Also shown is a hacker computer system 208.

[0068] The consumer network function 202 sends an SBI request message 210 that includes the CCA token. The SCP 204 receives the SBI request message 210 and forwards an SBI request message 212 to the producer network function 206.

[0069] The producer network function 206 verifies that the CCA token is signed by the consumer network function 202. In response to verifying the CCA token, the producer network function 206 sends an SBI response message 214 to the SCP 204. The SCP 204 receives the SBI response message 214 and forwards an SBI response message 216 to the consumer network function 202.

[0070] Hacker 208 intercepts the CCA token during the exchange. Hacker 208 then sends an SBI request message 218 with the stolen CCA token. SCP 204 receives SBI request message 218 and forwards SBI request message 220 to producer network function 206.

[0071] The producer network function 206 verifies that the CCA token is signed by the consumer network function 202, even though the CCA token should be rejected because the SBI request message 218 originated from the hacker 208. If the stolen CCA token is not expired, the producer network function 206 sends an SBI response message 222 to the SCP 204. The SCP 204 receives the SBI response message 222 and forwards the SBI response message 224 to the hacker 208.

[0072] 3 is a message flow diagram illustrating an example scenario 300 where use of a single-use CCA is successful in preventing misuse of a stolen CCA at a producer network function. In the example scenario 300, the producer network function 206 verifies the message hash of the single-use CCA.

[0073] The consumer network function 202 sends an SBI request message 310 that includes a single-use CCA token. The single-use CCA token includes a message hash of the SBI request message 310. The SCP 204 receives the SBI request message 310 and forwards an SBI request message 312 to the producer network function 206.

[0074] The producer network function 206 verifies that the single-use CCA token is signed by the consumer network function 202. The producer network function 206 also verifies that the message hash of the SBI request message 312 matches the message hash included in the single-use CCA token.

[0075] In response to validating the single-use CCA token, the producer network function 206 sends an SBI response message 314 to the SCP 204. The SCP 204 receives the SBI response message 314 and forwards an SBI response message 316 to the consumer network function 202.

[0076] Hacker 208 intercepts the single-use CCA token during the exchange. Hacker 208 then attempts to invoke a different SBI request by sending an SBI request message 318 with the stolen CCA token. SCP 204 receives SBI request message 318 and forwards SBI request message 320 to producer network function 206.

[0077] The producer network function 206 verifies that the stolen CCA token was signed by the consumer network function 202 and is not expired. The producer network function 206 attempts to verify that the message hash of the SBI request message 318 matches the message hash included in the single-use CCA token, but this attempt fails because the message hash included in the single-use CCA token, which is a hash of the original message 310, is not the same as the message hash of the message 318 from the hacker 208. Thus, the producer network function 206 can reject the request from the hacker 208.

[0078] 4 is a message flow diagram illustrating an example scenario 400 in which the use of a single-use CCA is successful in preventing the misuse of a stolen CCA in a proxy function. In the example scenario 400, the SCP 204 verifies the message hash of the single-use CCA.

[0079] The consumer network function 202 sends an SBI request message 410 that includes a single-use CCA token. The single-use CCA token includes a message hash of the SBI request message 410. The SCP 204 receives the SBI request message 410.

[0080] The SCP 204 verifies that the message hash of the SBI request message 410 matches the message hash included in the single-use CCA token. In response to verifying the message hash, the SCP 204 forwards the SBI request message 412 to the producer network function 206.

[0081] The producer network function 206 verifies that the single-use CCA token was signed by the consumer network function 202 and is not expired. In response to verifying the single-use CCA token, the producer network function 206 sends an SBI response message 414 to the SCP 204. The SCP 204 receives the SBI response message 414 and forwards an SBI response message 416 to the consumer network function 202.

[0082] Hacker 208 intercepts the single-use CCA token during the exchange. Hacker 208 then attempts to invoke a different SBI request by sending an SBI request message 418 with the stolen CCA token. SCP 204 receives the SBI request message 418 and attempts to verify that the message hash of the SBI request message 418 matches the message hash included in the single-use CCA token, but this attempt fails because the message hash included in the single-use CCA token is a hash of the original message 410, which is not the same as the message hash of the message 418 from hacker 208. Thus, SCP 204 can reject the request from hacker 208.

[0083] A single-use CCA token can be formatted, for example, as follows: { “sub”:“NFInstanceIDXXX” “aud”:“NRF” “3gppsbireqhash”:“sbiReqHash” “iat”:1616239022 "exp":1616339022 } The fields in an example CCA payload are described as follows:

[0084] [Table 3]

[0085] 5A shows an example of single-use CCA in encoded and decoded formats. The 3gppsbireqhash field is added to the conventional CCA described above as part of the single-use CCA solution.

[0086] FIG. 5B is a flow diagram illustrating an example method 500 for creating a message hash.

[0087] An HTTP header 502 is selected. Typically, only headers that are not allowed to be modified by a proxy are selected. For example, an operator policy may specify which headers are allowed to be modified by a proxy. The HTTP header is converted 504 into a JSON array string. The HTTP body 506 is also converted 508 into a JSON array string, for example with selected attributes.

[0088] The header JSON string is concatenated 510 with the body JSON string. The header JSON string is concatenated with the body JSON string to form a final string 512. A hash 514 is then applied to the final string 512. Any suitable type of hashing algorithm may be used.

[0089] One or more of the various features of a single-use CCA system may be configured for a particular operator or system, for example.

[0090] · Single-use CCA feature can be enabled based on SBA interface. Some SBA interfaces prioritize security over performance, while others prioritize performance over security. There is a trade-off between security and performance.

[0091] · Single-use CCA configuration is set on both the consumer and producer network functions.

[0092] · The consumer network function is configured to always add the SBI message hash to the CCA.

[0093] · The producer network function (or proxy) is configured to validate the SBI message hash with the CCA.

[0094] The table below shows an example configuration where single-use CCA is enabled only for the NRF management API and disabled for everything else.

[0095] [Table 4]

[0096] The single-use CCA system and method may provide one or more of the following advantages.

[0097] - Prevent security attacks that exploit stolen CCA. · Security attacks can cause complete network outages.

[0098] The solution can be enabled with a selective 5G SBA interface, providing the benefits of both enhanced security and performance.

[0099] When performed on SCP / SEPP, it provides a centralized configuration of the security aspects of CCA validation.

[0100] · It is extensible to both intra-PLMN and inter-PLMN messages. · Note that CCA can be used for inter-PLMN messages if mutual authentication exists between PLMNs.

[0101] · In addition to producer NF, it is extensible to SCP and SEPP. FIG. 6 is a flow diagram illustrating an example method 600 for creating a single-use authentication message.

[0102] The method 600 includes creating a message hash of at least a subset of the request message at a consumer network function of a core network of the communications network (602). The method 600 includes adding the message hash to a Client Credential Assertion (CCA) token for the consumer network function (604). The method 600 includes sending the request message with the CCA token from the consumer network function to the producer network function (606).

[0103] In some instances, the message hash is verified by the producer network function, and in some other instances, the message hash is verified by the proxy. Validating the message hash involves hashing the received message using the same hash algorithm used to generate the message hash and comparing the hash of the received message to the message hash in the CCA token. If the hash of the received message matches the message hash in the CCA token, the request message can be authenticated.

[0104] In some examples, the method 600 includes, at the producer network function, verifying that the CCA token is signed and unexpired, verifying that a hash of the received request message matches the message hash of the CCA token, and sending a response to the consumer network function.

[0105] In some examples, method 600 includes verifying, at a proxy between the consumer network function and the producer network function, that a hash of the received request message matches a message hash of the CCA token, and forwarding the request message to the producer network function in response to verifying that the hash of the received request message matches the message hash of the CCA token. In some examples, method 600 includes verifying, at the producer network function, that the CCA token is signed and unexpired, and sending a response to the consumer network function.

[0106] In some examples, creating the message hash includes using one or more portions of the request message that are designated not to be modified by proxies of the communication network, hi some examples, the one or more portions of the request message that are designated not to be modified by proxies of the communication network include an authority header of the request message.

[0107] In some examples, the method 600 includes enabling or disabling single-use authentication messages on a per-interface basis for multiple different interfaces of the network core.

[0108] In some examples, the network core is a 5G network core. In some examples, the CCA token includes a number of fields including a network function instance identifier, an issue timestamp, an expiration time, and a message hash.

[0109] In some examples, the request message is a public land mobile network (PLMN) message destined for a different PLMN that is configured for mutual authentication.

[0110] 7 is a flow diagram illustrating an example method 700 for receiving a single-use authentication message. The method 700 may be performed, for example, by a producer network function.

[0111] The method 700 includes receiving a request message including a CCA token (702). The method 700 includes verifying that the CCA token is signed and unexpired (704). The method 700 includes verifying that a hash of the received request message matches a message hash of the CCA token (706).

[0112] In some instances, the message hash is verified by the producer network function, and in some other instances, the message hash is verified by the proxy. Validating the message hash involves hashing the received message using the same hash algorithm used to generate the message hash and comparing the hash of the received message to the message hash in the CCA token. If the hash of the received message is identical to the message hash in the CCA token, the request message can be authenticated.

[0113] The scope of the present disclosure includes any feature or combination of features disclosed herein (either explicitly or implicitly), or any generalization of the disclosed features, regardless of whether such feature or generalization alleviates any or all of the problems described herein. Accordingly, new claims may be formulated during prosecution of this application (or an application claiming priority to this application) to any such combination of features.

[0114] In particular, with reference to the appended claims, features of the dependent claims may be combined with features of the independent claims, and features of each independent claim may be combined in any suitable manner and not merely in the specific combinations recited in the appended claims.

Claims

1. 1. A method for creating a single-use authentication message, comprising: creating a message hash of at least a subset of the request messages in a consumer network function of a core network of the communications network; at the consumer network function, appending the message hash to a Client Credential Assertion (CCA) token for the consumer network function; sending, from the consumer network function, the request message with the CCA token to a producer network function; A method comprising:

2. In the producer network function, Verifying that the CCA token is signed and unexpired; verifying that a hash of the received request message matches the message hash of the CCA token; sending a response to said consumer network function; The method of claim 1 , comprising:

3. In a proxy between the consumer network function and the producer network function, verifying that a hash of the received request message matches the message hash of the CCA token; in response to verifying that the hash of the received request message matches the message hash of the CCA token, forwarding the request message to the producer network function; The method of claim 1 , comprising:

4. In the producer network function, Verifying that the CCA token is signed and unexpired; sending a response to said consumer network function; The method of claim 3 , comprising:

5. The method of claim 1 , wherein creating the message hash includes using one or more portions of the request message that are designated as not to be altered by proxies of the communication network.

6. The method of claim 5 , wherein the one or more portions of the request message that are designated not to be modified by proxies of the communications network include an authority header of the request message.

7. 2. The method of claim 1, comprising enabling or disabling single-use authentication messages on a per-interface basis for a plurality of different interfaces of the network core.

8. The method of claim 1 , wherein the network core is a 5G network core.

9. The method of claim 8 , wherein the CCA token includes a number of fields including a network function instance identifier, an issue timestamp, an expiration time, and the message hash.

10. 2. The method of claim 1, wherein the request message is a Public Land Mobile Network (PLMN) message destined for a different PLMN configured for mutual authentication.

11. 1. A system for creating a single-use authentication message, comprising: at least one processor and memory; A system comprising a Consumer Network Function of a core network of a communications network implemented by said at least one processor, said Consumer Network Function being configured to perform a method according to any one of claims 1 to 10.

12. A program comprising executable instructions which, when executed by a processor of a computer, controls the computer to perform the method of any one of claims 1 to 10.

Images