Access Token Segmentation for Indirect NF Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In the 3GPP service-based architecture, NF service producers cannot match identifiers in access tokens with those in client TLS certificates when service requests are routed through service communication proxies, as only certificates for TLS connections are issued to NF consumers, and NRFs have additional public/private key pairs for signing access tokens.
Innovation Solution
A method and network equipment that generate access tokens including identifiers of NF consumers and all entities in the communication path, allowing verification of the last hop network entity and signature validation to grant access to services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If service requests are routed through service communication proxies in indirect communication scenarios, then service routing flexibility is improved, but the ability to match identifiers in access tokens with client TLS certificates deteriorates
Solution Approach 1:
The access token is segmented to include separate identifier fields: one for the NF consumer and another for the service communication proxy. This segmentation allows the NF service producer to independently verify both the consumer's identity and the proxy's identity, resolving the contradiction by maintaining identifier matching capability while supporting indirect communication routing flexibility.
Solution Approach 2:
The access token acts as an intermediary credential that carries both the NF consumer identifier and the service communication proxy identifier. This intermediary mechanism enables the NF service producer to verify the identity chain without requiring direct TLS certificate matching between consumer and producer, thus maintaining reliability while enabling routing flexibility through proxies.
2Reliability
If additional certificates or public/private key pairs are issued to NF consumers for token verification, then authentication reliability is improved, but device complexity and security management overhead increase
Solution Approach 1:
The access token serves multiple functions: it acts as both an authentication credential (verifying NF consumer identity) and an authorization credential (verifying service communication proxy identity). This multi-functionality eliminates the need for separate certificates or key pairs for different purposes, maintaining authentication reliability while reducing device complexity and security management overhead.
Solution Approach 2:
The system changes the parameter structure of the access token to include multiple identifier fields instead of relying on additional certificates. By modifying the token's data structure to carry both NF consumer identifier and proxy identifier, the system achieves reliable authentication without the complexity of managing multiple cryptographic credential sets.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
A method comprises receiving an access token request from a first network entity for granting access to a network function, NF, service producer. The method further comprises determining whether an access token can be granted for the first network entity. Responsive to determining that the access token can be granted, the method further comprises generating the access token that includes an identifier of a NF consumer associated with the first network entity and an identifier of each network entity in a communication path between the first network entity and the NF service producer and transmitting the access token towards the first network entity.