Access Token Binding to Public Key in 5G SBA
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current 5G Service-Based Architecture (SBA) lacks effective mechanisms to prevent access token theft attacks, especially in indirect communication scenarios, where the originator of the access token cannot be verified, leading to potential unauthorized service consumption.
Innovation Solution
The proposed solution involves binding the access token to the public key of the network function service consumer (NFc) or its hash, and verifying this binding throughout the communication path, including service communication proxies (SCPs), to ensure only the authorized NFc can use the access token.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If access token is used for authentication in SBA, then communication efficiency is improved, but security against token theft attacks deteriorates
Solution Approach 1:
The patent applies preliminary action by embedding the public key (or its hash) into the access token during the token issuance phase, before the actual service consumption occurs. This pre-binding mechanism ensures that when the token is later used, the holder can be verified without adding significant overhead to the communication flow, thus maintaining efficiency while enhancing security.
Solution Approach 2:
The patent introduces an intermediary verification mechanism where the public key acts as a mediator between the access token and the service consumer. Instead of directly trusting the token alone, the system uses the public key as an intermediate layer to verify the token's authenticity and bind it to the intended consumer, preventing theft and unauthorized use.
2Reliability
If access token binding to public key is implemented, then security against unauthorized access is improved, but device complexity increases
Solution Approach 1:
The patent uses copying by storing only the public key (or its hash) in the access token, rather than storing or transmitting the entire cryptographic credential set. The public key is a public copy of the consumer's identity that can be freely distributed and verified, providing strong security without requiring complex key management infrastructure on the service consumer side.
Solution Approach 2:
The patent applies parameter changes by transforming the complex cryptographic identity (private key + public key + certificates) into a simplified verification parameter (public key or its hash) that can be easily embedded in the access token and verified by service providers, reducing overall system complexity while maintaining security.
3Ease of operation
If access token is made universally valid, then ease of operation is improved, but vulnerability to theft attacks increases
Solution Approach 1:
The patent applies preliminary action by pre-binding the public key to the access token during issuance, creating an inherent link between the token and its intended consumer. This preliminary binding ensures that while the token remains universally valid for ease of operation, it cannot be stolen and used by unauthorized parties because verification requires matching the public key that was pre-associated with the token.
Data Source
AI summary
Various examples of embodiments described herein relate to methods and apparatuses for mitigation against access token theft attack in direct and indirect communications in SBA. One such example of an embodiment relates to a method that includes obtaining a first access token request from a network function service consumer, NFc, the first access token request comprising an authentication code of the NFc; authenticate the network function consumer, NFc, based on a check whether the authentication code is signed by the NFc; sending a second access token request to a network authorization entity or function, wherein the second access token request comprises the authentication code of the NFc and the second access token request further comprises a public key of the NFc or a hash of the public key of the NFc; based thereon, receiving an access token from the network authorization entity or function, wherein the access token comprises the public key of the NFc or a hash of the public key of the NFc; and sending a service request to a network function service provider, NFp, wherein the service request comprises the access token and the authentication code of the NFc.