5G Data Repository Access Using Producer Authorization Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current verification solutions for authorizing data consumers to access analytics information in 5G networks are inadequate, particularly in scenarios where data producers may not be aware of all potential consumers and when sensitive data like AI/ML models are involved.
Innovation Solution
Implement methods for data consumers and producers to exchange authorization tokens or signed strings with metadata, and for data repositories to verify authorization based on these tokens or random strings, ensuring only authorized entities can access stored analytics data or models.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data producers store analytics information in a data repository without comprehensive verification, then data accessibility and system simplicity are improved, but security and authorization control deteriorate
Solution Approach 1:
The system performs preliminary authorization verification before data access is granted. The data consumer must obtain authorization from the data producer before accessing stored analytics information, and the data repository verifies this authorization token before releasing data. This preliminary action prevents unauthorized access while maintaining ease of operation for authorized users.
Solution Approach 2:
The data repository acts as an intermediary between the data producer and data consumer. It receives authorization tokens from data producers, stores analytics information, and verifies tokens before releasing data to consumers. This intermediary role enables secure authorization control without complicating the overall system operation.
2Reliability
If comprehensive verification procedures are implemented for data authorization, then security and authorization control are improved, but system complexity and verification time deteriorate
Solution Approach 1:
Instead of complex cryptographic verification, the system uses authorization tokens as simplified copies or representations of access rights. These tokens contain necessary authorization information and can be easily verified by the data repository without complex computational procedures, reducing system complexity while maintaining security.
Solution Approach 2:
The verification process extracts only the essential authorization information from the complex authorization framework. The data repository verifies only the authorization token and its validity against stored credentials, separating the verification function from the complex authorization management system. This extraction simplifies the verification process while maintaining strong authorization control.
3Reliability
If data producers are made aware of all potential consumers, then authorization accuracy is improved, but system complexity and communication overhead deteriorate
Solution Approach 1:
The data consumer initiates the authorization process by requesting authorization from the data producer. The data producer then issues an authorization token to the consumer without needing to maintain awareness of all potential consumers. This self-service approach improves authorization accuracy while avoiding the complexity of tracking all possible consumers.
Solution Approach 2:
The system performs preliminary authorization verification before data access is granted. The data consumer must obtain authorization from the data producer before accessing stored analytics information, and the data repository verifies this authorization token before releasing data. This preliminary action prevents unauthorized access while maintaining ease of operation for authorized users.
Data Source
AI summary
Embodiments include methods for a data consumer network function (NFc) of a communication network. Such methods include sending, to a data producer network function (NFp) of the communication network, a first request for first data produced by the NFp and stored in a data repository function (DRF) of the communication network and receiving, from the NFp, a response that includes information that authorizes the NFc to access the first data stored in the DRF. Such methods include sending, to the DRF, a second request for the first data. The second request includes the information that authorizes the NFc to access the first data stored in the DRF. Such methods include receiving the first data from the DRF in response to the second request. Other embodiments include complementary methods for an NFp and a DRF, as well as network functions configured to perform such methods.