5G SCP Cryptographic Signing for Secure Service Requests
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In 5G core networks, the Services Communications Proxy (SCP) lacks secure mechanisms to verify the authenticity of service requests, allowing malicious SCPs to exploit trust and potentially intercept or misroute communications, leading to unauthorized access and eavesdropping of sensitive information.
Innovation Solution
Implementing a system where network function consumers create and sign service requests, which are verified by producers, using cryptographically signed objects that only the intended consumer can decrypt, ensuring authorized and timely requests are processed, and sensitive information remains confidential.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the SCP performs delegated discovery and message forwarding without verification mechanisms, then communication efficiency is improved, but security is worsened allowing malicious SCPs to intercept or misroute communications
Solution Approach 1:
The patent introduces cryptographic intermediaries (signing keys, certificates, and signed objects) between the NF consumer, SCP, and NF producer. The NF consumer signs service requests with its private key, and the NF producer verifies these requests using the consumer's public key. This intermediary verification mechanism allows the SCP to forward messages efficiently while preventing malicious interception, as the cryptographic signatures provide non-repudiable proof of authenticity without requiring the SCP to perform complex verification.
2Reliability
If direct communication between NF consumers and NF producers is implemented, then security is improved through direct verification, but device complexity is worsened due to increased cryptographic operations
Solution Approach 1:
The patent applies preliminary action by pre-registering NF consumers with the NF producer before actual service requests are made. During registration, the NF consumer provides its signing key or certificate to the NF producer in advance. This preliminary setup allows the NF producer to have verification credentials ready, so that when service requests are forwarded through the SCP, verification can be performed efficiently without complex real-time key exchange or establishment procedures.
3Reliability
If service requests are signed and verified cryptographically, then unauthorized access is prevented, but processing time is increased due to verification operations
Solution Approach 1:
The patent employs disposable, short-lived cryptographic tokens (signed service request objects) that are created for each service request and then discarded after verification. Rather than maintaining long-term complex cryptographic relationships or performing repeated expensive verification operations, the system creates lightweight signed objects containing essential verification data (signature, timestamp, service identifier) that can be quickly verified and then discarded. This approach minimizes processing time while maintaining strong authorization control.
Data Source
AI summary
Systems and methods enable secure service-based communications in networks that use a Services Communications Proxy (SCP). A Network Function (NF) producer receives a service request including an authorization token and a signed service request object, wherein the service request originates from an NF consumer of the wireless core network and is forwarded to the NF producer via the SCP. The NF producer verifies the signed service request object and generates, after the verifying, a service response. The service response includes a signed service response object. The NF producer sends, to the NF consumer and via the SCP, the service response with the signed service response object.