5G Data Repository Access Control with Producer Authorization Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current verification solutions for authorizing data consumers to access analytics information in 5G networks are inadequate, particularly in scenarios where data producers may not be aware of all potential consumers and when sensitive data like AI/ML models are involved.
Innovation Solution
Implement methods for data consumers and producers to exchange authorization tokens or signed strings with metadata, and for data repositories to verify these tokens using digital signatures or random strings to ensure authorized access to stored data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If data consumers can directly access analytics information from data repositories, then data access efficiency is improved, but security and authorization control deteriorate
Solution Approach 1:
The patent introduces an intermediary authorization verification mechanism between data consumers and data repositories. The data consumer first obtains authorization information from the data producer, then presents this information to the data repository for verification before data access is granted. This intermediary verification step ensures security while maintaining efficient data access for authorized entities.
2Quantity of substance
If data producers store all analytics information in data repositories, then data availability is improved, but access security and data protection deteriorate
Solution Approach 1:
The patent implements preliminary authorization verification before data access is allowed. The data consumer must first obtain authorization information from the data producer and present it to the data repository for verification. This preliminary action ensures that only authorized consumers can access the stored analytics information, preventing unauthorized access while maintaining data availability for legitimate users.
3Reliability
If authorization verification is performed for every data access request, then access security is improved, but system complexity and processing time deteriorate
Solution Approach 1:
The patent uses authorization information (such as authorization tokens or signed strings) that are copied and validated across the system. Instead of performing complex verification from scratch for each access request, the system validates these pre-generated authorization credentials, which simplifies the verification process while maintaining strong security.
4Ease of operation
If data consumers request analytics data without authorization verification, then operational simplicity is improved, but data protection and security deteriorate
Solution Approach 1:
The patent implements a self-service authorization model where data consumers autonomously obtain authorization information from data producers and present it to data repositories. This self-service approach maintains operational simplicity for authorized users while ensuring data protection, as the authorization verification is automatically performed by the data repository without requiring manual intervention.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
Embodiments include methods for a data consumer network function (NFc) of a communication network. Such methods include sending, to a data producer network function (NFp) of the communication network, a first request for first data produced by the NFp and stored in a data repository function (DRF) of the communication network and receiving, from the NFp, a response that includes information that authorizes the NFc to access the first data stored in the DRF. Such methods include sending, to the DRF, a second request for the first data. The second request includes the information that authorizes the NFc to access the first data stored in the DRF. Such methods include receiving the first data from the DRF in response to the second request. Other embodiments include complementary methods for an NFp and a DRF, as well as network functions configured to perform such methods.