Methods, systems, and computer-readable media for single-use authentication messages

Abstract

A method for creating a single-use authentication message includes creating a message hash of at least a subset of a request message at a consumer network function of a core network of a communications network, the method including appending the message hash to a Client Credential Assertion (CCA) token for the consumer network function at the consumer network function, and sending the request message with the CCA token from the consumer network function to a producer network function.

Description

Technical Field

[0001] Priority Claim This application claims the benefit of priority of U.S. Patent Application No. 17 / 314,382, filed on May 7, 2021, the disclosure of which is incorporated herein by reference in its entirety.

[0002] Technical Field The subject matter described herein relates to secure communications within a communication network. More particularly, the subject matter described herein relates to methods, systems, and computer-readable media for single-use authentication messages.

Background Art

[0003] Background In a fifth-generation (5G) communication network, a network node that provides a service is called a producer network function (NF). A network node that consumes a service is called a consumer NF. A network function can be both a producer NF and a consumer NF depending on whether it consumes or provides a service.

[0004] A given producer NF may have many service endpoints, and a service endpoint is a contact point for one or more NF instances hosted by the producer NF. A service endpoint is identified by a combination of an Internet Protocol (IP) address and a port number, or a fully qualified domain name that resolves to an IP address and a port number on the network node hosting the producer NF. An NF instance is an instance of a producer NF that provides a service. A given producer NF may include multiple NF instances. It should also be noted that multiple NF instances can share the same service endpoint.

[0005] Producer NFs register with the Network Functional Repository (NRF). The NRF maintains service profiles of available NF instances, identifying the services supported by each NF instance. Consumer NFs can subscribe to receive information about producer NF instances registered with the NRF. In addition to consumer NFs, another type of network node that can subscribe to receive information about NF service instances is a Service Communication Proxy (SCP). SCPs subscribe to the NRF to obtain reachability and service profile information about producer NF service instances. Consumer NFs SCP Connect to, SCP This either load-balances traffic across producer NF service instances that provide the necessary services, or routes traffic directly to the destination producer NF instance.

[0006] The Third Generation Partnership Project (3GPP®) proposes using the 3gpp-Sbi-Client-Credentials header (CCA: Client Credential Assertion) for client authentication in certain situations. One problem with using CCA is that this process does not provide protection against stolen CCA tokens. For example, a hacker with access to a stolen CCA could use it to invoke another SBI request within the network.

[0007] Considering these and other difficulties, there is a need for methods, systems, and computer-readable media for single-use authentication messages. [Overview of the project]

[0008] overview A method for creating a single-use authentication message includes creating a message hash of at least a subset of the request message in the consumer network function of the core network of the communication network. This method also includes adding the message hash to the client credential assertion (CCA) token for the consumer network function in the consumer network function. This method also includes sending a request message containing the CCA token from the consumer network function to the producer network function.

[0009] According to another aspect of the subject matter described herein, the method includes, in a producer network function, verifying that a CCA token is signed and not expired, verifying that the hash of an received request message matches the message hash of a CCA token, and sending a response to a consumer network function.

[0010] According to another aspect of the subject matter described herein, the method includes, at a proxy between a consumer network function and a producer network function, verifying that the hash of an received request message matches the message hash of a CCA token, and, in response to verifying that the hash of an received request message matches the message hash of a CCA token, forwarding the request message to the producer network function.

[0011] According to another aspect of the subject matter described herein, the method includes verifying in a producer network function that a CCA token is signed and not expired, and sending a response to a consumer network function.

[0012] According to another aspect of the subject matter described herein, creating a message hash involves using one or more portions of a request message that are designated not to be modified by a proxy on a communication network.

[0013] According to another aspect of the subject matter described herein, one or more parts of a request message designated not to be modified by a proxy of a communication network include an authority header of the request message.

[0014] According to another aspect of the subject matter described herein, the method includes enabling or disabling single-use authentication messages for each interface for multiple different interfaces of a network core.

[0015] According to another aspect of the subject matter described herein, the network core is a 5G network core.

[0016] According to another aspect of the subject matter described herein, a CCA token includes several fields, including a network function instance identifier, an issuance timestamp, an expiration time, and a message hash.

[0017] According to another aspect of the subject matter described herein, a request message is a public land mobile network (PLMN) message destined for different PLMNs configured for mutual authentication.

[0018] According to another aspect of the subject matter described herein, a system for creating a single-use authentication message comprises at least one processor and one memory. The system further comprises a consumer network function of a core network of a communication network, the consumer network function being performed by at least one processor and configured to create message hashes of at least a subset of request messages, add the message hashes to a CCA token of the consumer network function, and send the request messages together with the CCA token to the producer network function.

[0019] According to another aspect of the subject matter described herein, the producer network function is configured to verify that the CCA token is signed and not expired, to verify that the hash of the received request message matches the message hash of the CCA token, and to send a response to the consumer network function.

[0020] According to another aspect of the subject matter described herein, the system includes a proxy between a consumer network function and a producer network function, the proxy being configured to verify that the hash of an incoming request message matches the message hash of a CCA token, and in response to the verification that the hash of the incoming request message matches the message hash of a CCA token, forward the request message to the producer network function.

[0021] According to another aspect of the subject matter described herein, the producer network function is configured to verify that the CCA token is signed and not expired, and to send a response to the consumer network function.

[0022] According to another aspect of the subject matter described herein, the creation of a message hash involves using one or more portions of a request message that are designated not to be modified by a proxy on a communication network.

[0023] According to another aspect of the subject matter described herein, one or more parts of a request message designated not to be modified by a proxy of a communication network include an authority header of the request message.

[0024] According to another aspect of the subject matter described herein, the consumer network function is configured to enable or disable single-use authentication messages for each interface for multiple different interfaces of the network core.

[0025] According to another aspect of the subject matter described herein, the network core is a 5G network core.

[0026] According to another aspect of the subject matter described herein, the CCA token includes a plurality of fields including a network function instance identifier, an issue time stamp, a validity period, and a message hash.

[0027] According to another aspect of the subject matter described herein, the request message is a public land mobile network (PLMN) message addressed to different PLMNs configured for mutual authentication.

[0028] According to another aspect of the subject matter described herein, there is provided a non-transitory computer-readable medium storing executable instructions that, when executed by a processor of a computer, control the computer to execute steps. The steps include creating a message hash of at least a subset of request messages in a consumer network function of a core network of a communication network, adding the message hash to a CCA token of the consumer network function in the consumer network function, and transmitting the request message from the consumer network function to a producer network function together with the CCA token.

[0029] The subject matter described herein can be implemented in software in combination with hardware and / or firmware. For example, the subject matter described herein can be implemented in software executed by a processor. According to one exemplary embodiment, the subject matter described herein can be implemented using a computer-readable medium storing computer-executable instructions that, when executed by a processor of a computer, control the computer to execute steps.

[0030] Examples of computer-readable media suitable for carrying out the subject matter described herein include non-transient devices such as disk memory devices, chip memory devices, programmable logic devices, and application-specific integrated circuits. Furthermore, computer-readable media for carrying out the subject matter described herein may be located on a single device or computing platform, or may be distributed across multiple devices or computing platforms.

[0031] Next, the subjects described herein will be explained with reference to the accompanying drawings. [Brief explanation of the drawing]

[0032] [Figure 1] This is a block diagram showing an example of a 5G system network architecture. [Figure 2] This message flow diagram illustrates an example scenario where a hacker successfully misuses stolen CCA tokens. [Figure 3] This message flow diagram illustrates an example scenario where the use of a single-use CCA successfully prevents the misuse of a stolen CCA in the producer network function. [Figure 4] This message flow diagram illustrates an example scenario where the use of a single-use CCA successfully prevents the misuse of stolen CCA tokens in the proxy function. [Figure 5A] This figure shows an example of a single-use CCA in the encoded and decoded formats. [Figure 5B] This flowchart shows an example of how to create a message hash. [Figure 6] This flowchart illustrates an example of how to create a single-use authentication message. [Figure 7] This flowchart illustrates an example of a method for receiving a single-use authentication message. [Modes for carrying out the invention]

[0033] Detailed explanation The subject matter described herein relates to methods, systems, and computer-readable media for single-use authentication messages.

[0034] In a 5G communication network, network nodes that provide services are called Producer Network Functions (NFs). Network nodes that consume services are called Consumer NFs. A network function can be either a Producer NF or a Consumer NF, depending on whether it consumes or provides services. An NF instance is an instance of a Producer NF that provides services. A given Producer NF may contain multiple NF instances.

[0035] 3GPP suggests using the 3gpp-Sbi-Client-Credentials header (CCA: Client Credential Assertion) for client authentication in certain situations. One problem with using CCA is that this process does not provide protection against stolen CCA tokens. For example, a hacker with access to a stolen CCA could use it to invoke another SBI request within the network.

[0036] The existing expiration field in CCAs does not completely protect against token theft attacks. Rather, the existing expiration field makes attacks more difficult by allowing hackers to request another SBI request before the CCA expires. Shortening the expiration time does not completely protect against exploitation.

[0037] Furthermore, not all SBI APIs are equivalent in terms of security and performance. Some SBI APIs require high security, such as NRF deregistration, while others allow for a trade-off between security and performance. It can be useful to allow network functions to make trade-offs between security and performance.

[0038] This specification describes a method and system for creating and using single-use CCA tokens in the core network of a communications network. Using single-use CCA tokens prevents hackers from using stolen CCAs to invoke other SBI requests within the network.

[0039] Figure 1 is a block diagram showing an example of a 5G system network architecture. The architecture in Figure 1 includes an NRF100 and an SCP101, which may be located in the same Home Public Land Mobile Network (HPLMN). The NRF100 maintains profiles of available producer NF service instances and their supported services, and may allow consumer NFs or SCPs to subscribe to and be notified of new / updated producer NF service instances.

[0040] SCP101 may also support service discovery and service selection for producer NF instances. SCP101 may perform load balancing of connections between consumer NFs and producer NFs. Furthermore, using the methodology described herein, SCP101 may perform selection and routing based on preferred NF locations.

[0041] NRF100 is a repository for NF or service profiles of producer NF instances. To communicate with a producer NF instance, a consumer NF or SCP must obtain the NF or service profile, or the producer NF instance, from NRF100. An NF or service profile is a JavaScript® object notation (JSON) data structure as defined in 3GPP Technical Specification (TS) 29.510.

[0042] In Figure 1, any of the nodes (other than NRF100) can be either a consumer NF or a producer NF, depending on whether they are requesting or providing a service. In the illustrated example, the node is a policy control function (PCF) 102 that performs policy-related actions within the network and manages user data. Integration It includes a data management (UDM) function 104 and an application function (AF) 106 that provides application services.

[0043] The node shown in Figure 1 further includes a Session Management Function (SMF) 108 that manages the session between the Access and Mobility Management Function (AMF) 110 and the PCF 102. The AMF 110 performs mobility management operations similar to those performed by a Mobility Management Entity (MME) in a 4G network. The Authentication Server Function (AUSF) 112 performs authentication services for user devices (UEs), such as user devices (UEs) 114, that request access to the network.

[0044] The Network Slice Selection Function (NSSF) 116 provides network slice services for devices seeking to access specific network capabilities and network characteristics associated with a network slice. The Network Disclosure Function (NEF) 118 provides an application programming interface (API) for application functions seeking to obtain information about Internet of Things (IoT) devices and other UEs connected to the network. The NEF 118 performs functions similar to those of the Service Capability Disclosure Function (SCEF) in 4G networks.

[0045] The Wireless Access Network (RAN) 120 connects the User Equipment (UE) 114 to the network via a wireless link. The Wireless Access Network 120 may be accessed using a g-node B (gNB) (not shown in Figure 1) or other wireless access points. The User Plane Function (UPF) 122 can support various proxy functions for user plane services. One example of such a proxy function is the Multipath Transmission Control Protocol (MPTCP) proxy function.

[0046] UPF122 may also support performance measurement capabilities that the UE114 can use to obtain network performance measurements. Figure 1 also illustrates the data network (DN)124 to which the UE accesses data network services such as Internet services.

[0047] SEPP126 filters incoming traffic from another PLMN and performs topology concealment for traffic leaving the home PLMN. SEPP126 may also communicate with the SEPP of the foreign PLMN that manages the security of the foreign PLMN. Thus, traffic between NFs in different PLMNs may pass through two SEPP functions, one for the home PLMN and the other for the foreign PLMN.

[0048] Sections 13.3.1.2 and 13.3.2.2 of 3GPP Technical Specification 33501 propose the use of CCA for indirect communications for NF-to-NRF and NF-to-NF communications.

[0049] Section 13.3.8.2 of 3GPP Technical Specification 33501 proposes that the CCA token include the following:

[0050] • NF instance ID of the NF service user (subject) • Timestamp (iat) and validity period (exp), and • The expected audience's NF type, namely type "NRF" or "NF Service Producer". The NF service consumer is configured to digitally sign the generated CCA based on its private key, as described in RFC7515. The signed CCA shall include one of the following fields:

[0051] • X.509 URL (x5u) for referencing the X.509 public certificate to verify the CCA.

[0052] The X.509 certificate chain (x5c) includes an X.509 public certificate for verifying the CCA.

[0053] Section 5.2.3.2.11 of TS29.500 describes 3gpp-Sbi-Client-Credentials with the following attributes:

[0054] [Table 1]

[0055] For example, a sample CCA payload can be expressed as follows: { “sub”:“NFInstanceIDXXX” “aud”:“NRF” “iat”:1616239022 “exp”:1616339022 } The fields in the CCA payload include the following:

[0056] [Table 2]

[0057] One of the problems with using CCA is that the process does not provide protection against stolen CCA tokens. For example, a hacker who has access to a stolen CCA could use it to make another SBI request within the network.

[0058] The existing expiration field in CCAs does not completely protect against token theft attacks. Rather, the existing expiration field makes attacks more difficult by allowing hackers to request another SBI request before the CCA expires. Shortening the expiration time does not completely protect against exploitation.

[0059] To prevent this type of abuse, one or more network functions can be configured to use a single-use CCA. A single-use CCA is single-use in the sense that it can only be used to authenticate a single message. To create and use a single-use CCA, the system can be configured as follows:

[0060] • Create a CCA that can only be used once, so that even if the CCA token is stolen, it cannot be misused.

[0061] To restrict a CCA to being usable only once, add an SBI message (HTTP header + body) hash to the CCA.

[0062] All header or body attributes that are permitted to be modified by the proxy shall be excluded when generating the hash.

[0063] For example, the authority header should not be part of the SBI message hash because it may be updated by SCP for alternative routing.

[0064] By adding the SBI message hash to the CCA, it is guaranteed that the CCA can be used only once for a given SBI message.

[0065] Verification of a single-use CCA can be performed at either the SCP or Producer NF, depending on the operator's policy.

[0066] • CCA can be enabled or disabled based on the service-based interface. For example, an operator can choose to enable CCA for NF management service APIs where high security is required, and disable it for other APIs.

[0067] Figure 2 is a message flow diagram illustrating a scenario 200 in which a hacker successfully misuses a stolen CCA token. Figure 2 shows exemplary consumer network functions 202, exemplary proxy (SCP) 204, and exemplary producer network functions 206. A hacker computer system 208 is also shown.

[0068] Consumer network function 202 sends an SBI request message 210 containing a CCA token. SCP 204 receives the SBI request message 210 and forwards the SBI request message 212 to producer network function 206.

[0069] The producer network function 206 verifies that the CCA token is signed by the consumer network function 202. In response to the verification of the CCA token, the producer network function 206 sends an SBI response message 214 to SCP204. SCP204 receives the SBI response message 214 and forwards an SBI response message 216 to the consumer network function 202.

[0070] Hacker 208 intercepts the CCA token during the exchange. Hacker 208 then sends SBI request message 218 using the stolen CCA token. SCP204 receives SBI request message 218 and forwards SBI request message 220 to producer network function 206.

[0071] Producer network function 206 verifies that the CCA token is signed by consumer network function 202, even though the CCA token should be rejected because the SBI request message 218 originated from hacker 208. If the stolen CCA token is not expired, producer network function 206 sends SBI response message 222 to SCP 204. SCP 204 receives SBI response message 222 and forwards SBI response message 224 to hacker 208.

[0072] Figure 3 is a message flow diagram illustrating Scenario 300, in which the use of a single-use CCA successfully prevents the misuse of a stolen CCA in the producer network function. In Scenario 300, the producer network function 206 verifies the message hash of the single-use CCA.

[0073] Consumer network function 202 sends an SBI request message 310 containing a single-use CCA token. The single-use CCA token contains the message hash of the SBI request message 310. SCP 204 receives the SBI request message 310 and forwards the SBI request message 312 to producer network function 206.

[0074] The producer network function 206 verifies that the single-use CCA token is signed by the consumer network function 202. The producer network function 206 also verifies that the message hash of the SBI request message 312 matches the message hash contained in the single-use CCA token.

[0075] In response to the verification of the single-use CCA token, producer network function 206 sends SBI response message 314 to SCP204. SCP204 receives SBI response message 314 and forwards SBI response message 316 to consumer network function 202.

[0076] Hacker 208 intercepts a single-use CCA token during the exchange. Hacker 208 then attempts to invoke a different SBI request by sending SBI request message 318 with the stolen CCA token. SCP204 receives SBI request message 318 and forwards SBI request message 320 to producer network function 206.

[0077] Producer network function 206 verifies that the stolen CCA token was signed by consumer network function 202 and is not expired. Producer network function 206 attempts to verify that the message hash of SBI request message 318 matches the message hash contained in the single-use CCA token. However, this attempt fails because the message hash contained in the single-use CCA token is the hash of the original message 310, and therefore is not the same as the message hash of message 318 from hacker 208. Thus, producer network function 206 can reject the request from hacker 208.

[0078] Figure 4 is a message flow diagram illustrating Scenario 400, in which the use of a single-use CCA successfully prevents the misuse of a stolen CCA in the proxy function. In Scenario 400, SCP204 verifies the message hash of the single-use CCA.

[0079] Consumer network function 202 sends an SBI request message 410 containing a single-use CCA token. The single-use CCA token contains the message hash of the SBI request message 410. SCP204 receives the SBI request message 410.

[0080] SCP204 verifies that the message hash of SBI request message 410 matches the message hash contained in the single-use CCA token. In response to the message hash verification, SCP204 forwards SBI request message 412 to producer network function 206.

[0081] Producer network function 206 verifies that the single-use CCA token is signed by consumer network function 202 and is not expired. In response to the verification of the single-use CCA token, producer network function 206 sends SBI response message 414 to SCP204. SCP204 receives SBI response message 414 and forwards SBI response message 416 to consumer network function 202.

[0082] Hacker 208 intercepts a single-use CCA token during the exchange. Hacker 208 then attempts to invoke a different SBI request by sending SBI request message 418 with the stolen CCA token. SCP204 receives SBI request message 418 and attempts to verify that the message hash of SBI request message 418 matches the message hash contained in the single-use CCA token. However, this attempt fails because the message hash contained in the single-use CCA token is the hash of the original message 410, and therefore is not the same as the message hash of message 418 from Hacker 208. Thus, SCP204 can reject the request from Hacker 208.

[0083] A single-use CCA token can be formatted as follows, for example: { “sub”:“NFInstanceIDXXX” “aud”:“NRF” “3gppsbireqhash”:“sbiReqHash” “iat”:1616239022 “exp”:1616339022 } The fields in the example CCA payload are described as follows:

[0084] [Table 3]

[0085] Figure 5A shows an example of a single-use CCA in the encoded and decoded formats. The 3gppsbireqhash field is added to the conventional CCA described above as part of the single-use CCA solution.

[0086] Figure 5B is a flowchart illustrating an example of a method for creating a message hash.

[0087] HTTP header 502 is selected. Typically, only headers that are not allowed to be modified by the proxy are selected. For example, an operator policy may specify which headers are allowed to be modified by the proxy. The HTTP headers are converted to a JSON array string 504. The HTTP body 506 is also converted to a JSON array string 508, for example, with the attributes to be selected.

[0088] The header JSON string is concatenated with the body JSON string. The header JSON string is concatenated with the body JSON string to form the final string. Then, a hash is applied to the final string. Any suitable type of hash algorithm can be used.

[0089] One or more of the various features of a single-use CCA system can be configured, for example, for a specific operator or system.

[0090] • Single-use CCA features can be enabled based on the SBA interface. Some SBA interfaces prioritize security over performance, while others prioritize performance over security. Security and performance are in a trade-off relationship.

[0091] • The single-use CCA configuration is set for both consumer network functions and producer network functions.

[0092] The consumer network function is configured to always add the SBI message hash to the CCA.

[0093] • The producer network function (or proxy) is configured to verify the SBI message hash in CCA.

[0094] The table below shows an example configuration where the single-use CCA is enabled only for the NRF management API and disabled for all others.

[0095] [Table 4]

[0096] A single-use CCA system and method can offer one or more of the following advantages:

[0097] • Prevent security attacks that exploit stolen CCA. Security attacks can cause a complete network outage.

[0098] The solution can be enabled with a selective 5G SBA interface, offering the benefit of enhanced security and performance.

[0099] • When implemented on SCP / SEPP, a centralized security configuration for CCA verification is provided.

[0100] • It can be extended to both intra-PLMN messages and inter-PLMN messages. Note that if mutual authentication exists between PLMNs, CCA can be used for inter-PLMN messages.

[0101] • In addition to Producer NF, it can also be extended to SCP and SEPP. Figure 6 is a flowchart showing an example of a method for creating a single-use authentication message.

[0102] Method 600 includes creating a message hash of at least a subset of the request message in the consumer network function of the core network of the communication network (602). Method 600 includes adding the message hash to the client credential assertion (CCA) token for the consumer network function in the consumer network function (604). Method 600 includes sending a request message having the CCA token from the consumer network function to the producer network function (606).

[0103] In some examples, the message hash is verified by the producer network function, and in other examples, the message hash is verified by the proxy. Message hash verification involves hashing the incoming message using the same hash algorithm used to generate the message hash, and comparing the hash of the incoming message to the message hash of the CCA token. If the hash of the incoming message matches the message hash of the CCA token, the request message can be authenticated.

[0104] In some examples, method 600 includes verifying in the producer network function that the CCA token is signed and not expired, verifying that the hash of the received request message matches the message hash of the CCA token, and sending a response to the consumer network function.

[0105] In some examples, method 600 includes, at a proxy between the consumer network function and the producer network function, verifying that the hash of the received request message matches the message hash of the CCA token, and forwarding the request message to the producer network function in response to verifying that the hash of the received request message matches the message hash of the CCA token. In some examples, method 600 includes, at the producer network function, verifying that the CCA token is signed and not expired, and sending a response to the consumer network function.

[0106] In some examples, creating a message hash involves using one or more parts of a request message that are designated not to be modified by a proxy on the communication network. In some examples, one or more parts of a request message that are designated not to be modified by a proxy on the communication network include the authority header of the request message.

[0107] In some examples, method 600 includes enabling or disabling single-use authentication messages on a per-interface basis for multiple different interfaces of a network core.

[0108] In some examples, the network core is a 5G network core. In some examples, the CCA token includes multiple fields, including a network function instance identifier, issuance timestamp, validity period, and message hash.

[0109] In some examples, the request message is a public land mobile network (PLMN) message destined for different PLMNs configured for mutual authentication.

[0110] Figure 7 is a flowchart illustrating an example method 700 for receiving a single-use authentication message. Method 700 can be performed, for example, by a producer network function.

[0111] Method 700 includes receiving a request message containing a CCA token (702). Method 700 includes verifying that the CCA token is signed and not expired (704). Method 700 includes verifying that the hash of the received request message matches the message hash of the CCA token (706).

[0112] In some examples, the message hash is verified by the producer network function, and in other examples, the message hash is verified by the proxy. Message hash verification involves hashing the incoming message using the same hash algorithm used to generate the message hash, and comparing the hash of the incoming message to the message hash of the CCA token. If the hash of the incoming message is identical to the message hash of the CCA token, the request message can be authenticated.

[0113] The scope of this disclosure includes any feature or combination of features disclosed herein (whether express or implicit), or any generalization of any feature or generalization thereof, regardless of whether such feature or generalization mitigates any or all of the issues described herein. Accordingly, new claims can be formulated for any combination of such features during the examination of this application (or an application claiming priority to this application).

[0114] In particular, by reference to the attached claims, the features of the dependent claims may be combined with the features of the independent claims, and each feature of the independent claim may be combined in any appropriate manner, rather than simply in the specific combinations listed in the attached claims.

Claims

1. A method for creating a single-use authentication message, The consumer network function of the core network of a communication network includes creating a message hash of at least a subset of the request message, wherein creating the message hash includes using one or more parts of the request message that are designated not to be modified by the proxy of the communication network, and the method further includes: In the aforementioned consumer network function, the message hash is added to the client credential assertion (CCA) token for the consumer network function, The consumer network function sends the request message containing the CCA token to the producer network function. Methods that include...

2. In the aforementioned producer network function, The CCA token mentioned above is to be verified to be signed and not expired, Verify that the hash of the received request message matches the message hash of the CCA token, Sending a response to the consumer network function The method according to claim 1, including the method described in claim 1.

3. A method for creating a single-use authentication message, In the consumer network function of the core network of a communication network, the creation of message hashes for at least a subset of request messages, In the aforementioned consumer network function, the message hash is added to the client credential assertion (CCA) token for the consumer network function, The consumer network function sends the request message containing the CCA token to the producer network function, In the proxy between the consumer network function and the producer network function, Verify that the hash of the received request message matches the message hash of the CCA token, In response to verifying that the hash of the received request message matches the message hash of the CCA token, the request message is forwarded to the producer network function. Methods that include...

4. In the aforementioned producer network function, The CCA token mentioned above is to be verified to be signed and not expired, Sending a response to the consumer network function The method according to claim 3, including the method described in claim 3.

5. The method according to claim 1, wherein the one or more portions of the request message designated not to be modified by the proxy of the communication network include the authority header of the request message.

6. The method according to claim 1, comprising enabling or disabling single-use authentication messages for each interface for a plurality of different interfaces of the core network.

7. The method according to claim 1, wherein the core network is a 5G core network.

8. The method according to claim 7, wherein the CCA token includes a plurality of fields, including a network function instance identifier, a timestamp at the time of issuance, an expiration time, and the message hash.

9. The method according to claim 1, wherein the request message is a public land mobile network (PLMN) message destined for different PLMNs configured for mutual authentication.

10. A system for creating single-use authentication messages, At least one processor and memory, A system comprising a consumer network function of a core network of a communication network, which is performed by at least one processor, wherein the consumer network function is configured to perform the method according to any one of claims 1 to 9.

11. A program, when executed by a computer processor, comprising executable instructions that control the computer to perform the method according to any one of claims 1 to 9.

Images