Subscription Processing With Access-Token Verification for Network APIs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In 4G and 5G wireless communication systems, there is a need for effective security verification of non-trusted entities outside the operator domain before exposing network information to application functions or service capability servers, which is currently unresolved.
Innovation Solution
A subscription processing method involving obtaining an access token for security verification, sending a service request message with the token, and performing security verification on the entity, ensuring secure communication by using OAuth2.0 specifications and TLS sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If network information is exposed to third-party applications via APIs, then network accessibility and service capability are improved, but security risks and vulnerability to unauthorized access increase
Solution Approach 1:
The patent introduces an SCEF entity as an intermediary between the 3GPP network and third-party applications. The SCEF receives service requests from external applications, performs security verification, and forwards authorized requests to the network. This mediator architecture enables network accessibility while filtering out security threats before they reach the core network.
Solution Approach 2:
The patent implements preliminary security verification and authentication before allowing any network information exposure. The SCEF performs security checks, validates application credentials, and establishes trusted relationships in advance. Only after successful preliminary verification are APIs activated and network information made accessible to third-party applications.
2Reliability
If security verification is performed on external entities, then system security is improved, but processing complexity and verification overhead increase
Solution Approach 1:
The patent implements a self-service authentication mechanism where external applications must obtain their own credentials and perform self-registration with the SCEF. The system provides automated credential validation and trust establishment without requiring manual verification. This self-service approach enhances security while reducing operational complexity.
Solution Approach 2:
The SCEF entity is designed with universal functionality to handle multiple types of external applications, service requests, and authentication methods through a single unified interface. The security verification mechanism is generic and can authenticate diverse entities using standardized procedures, reducing the need for application-specific verification logic and lowering overall system complexity.
3Adaptability or versatility
If network information is made accessible to application functions, then service capability is improved, but information confidentiality and integrity risks increase
Solution Approach 1:
The SCEF acts as a confidential intermediary that selectively exposes only authorized network information to third-party applications. It filters, transforms, and controls the flow of information based on verification results and authorization policies. This mediator ensures that service capability is enhanced while information confidentiality is maintained by preventing unauthorized data exposure.
Solution Approach 2:
The patent implements local quality control by applying different levels of information exposure and security verification to different applications and service types. The SCEF tailors the amount and type of network information revealed based on the specific authorization level of each application. This selective information disclosure maintains confidentiality while providing necessary service capability.
Data Source
AI summary
In a wireless communication network, a subscription processing method, performed by a first entity, includes: obtaining an access token, in which the access token is used for representing security verification information used by the first entity in requesting to process a subscription service; sending a first service request message to a second entity according to the subscription service to be requested and the access token, in which the first service request message includes the access token; and receiving a first service response message sent by the second entity to obtain a processing result of the subscription service, in which the first service response message is a message sent by the second entity after performing a security verification on the first entity according to the access token.