5G Service Access Token with Multi-Instance Pool
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing 5G network approaches for service access authorization are inefficient, as they bind access tokens to specific NF producer instances, preventing selection from a pool of instances and requiring new tokens for each service request.
Innovation Solution
The proposed solution involves generating a JSON Web Token-based access token that includes end-point addresses of multiple NF producer instances, allowing selection logic to choose a producer based on criteria such as load balancing, and enabling the use of a single access token for multiple service requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access tokens are bound to specific NF producer instances, then service access authorization is secured, but selection from a pool of instances is prevented and token renewal is required for each service request
Solution Approach 1:
The access token is segmented into multiple distinct components: an authorization component that provides security validation, and a service selection component that contains a pool of NF producer instance identifiers. This segmentation allows the token to simultaneously provide both authorization security and instance selection flexibility without compromising either function.
Solution Approach 2:
The access token is designed as a multi-functional data structure that serves multiple purposes: it authenticates the service consumer, authorizes access to the service type, and provides a pool of available NF producer instances for selection. This universal design eliminates the need for separate tokens for authorization and instance selection, and removes the requirement for token renewal on each service request.
2Reliability
If access tokens are bound to specific NF producer instances, then service access is controlled, but load balancing across multiple instances is prevented
Solution Approach 1:
The access token incorporates a dynamic service selection mechanism that maintains a pool of NF producer instance identifiers rather than binding to a single static instance. This dynamic structure enables runtime selection of appropriate instances based on current system conditions such as load, availability, and performance metrics, thereby enabling effective load balancing while maintaining access control.
3Reliability
If new access tokens are generated for each service request, then access authorization is maintained, but system efficiency is reduced due to frequent token renewal
Solution Approach 1:
The access token is generated in advance with a predefined scope and validity period, incorporating both authorization credentials and a pool of service producer instances. This preliminary action eliminates the need for repeated token generation and renewal operations for each service request within the token's validity period, significantly reducing system overhead and improving efficiency while maintaining continuous authorization validation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An authorization entity in a communication system comprising a service-based architecture receives a request from a service consumer in the communication system for access to a given service type. The authorization entity obtains an access token that identifies a plurality of service producers for the given service type and sends the access token to the service consumer.