API Authorization Verification for Terminal Data Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication technologies in the 3GPP framework do not adequately consider user authorization when invoking application programming interfaces (APIs), leading to potential security risks and leakage of sensitive terminal device information.
Innovation Solution
Implement a method and system for invoking APIs that include obtaining authorization results based on terminal device and application identifiers, using a permission storage network element to determine whether an application server is allowed to operate device information, thereby reducing information leakage risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If mutual authentication is performed between API providing network element and AF network element, then authentication security is improved, but user authorization is not considered leading to information leakage risks
Solution Approach 1:
The patent segments the authentication process into two distinct phases: mutual authentication between network elements, and separate user authorization verification. This segmentation allows each phase to address its specific security requirement independently, preventing information leakage while maintaining authentication security.
Solution Approach 2:
The patent introduces an intermediary authorization verification mechanism that mediates between the authenticated AF network element and the terminal device information. This intermediary layer ensures that even after successful authentication, information is only accessed with proper user authorization, thus preventing information leakage.
2Reliability
If authorization verification is added to the API invocation process, then information security is improved, but processing complexity increases
Solution Approach 1:
The patent implements preliminary user authorization verification before API invocation. By checking authorization in advance and obtaining user consent beforehand, the system avoids complex real-time authorization decisions during API processing, thereby reducing processing complexity while maintaining security.
3Object-affected harmful factors
If user authorization is considered during API invocation, then information leakage risk is reduced, but processing time increases
Solution Approach 1:
The patent performs user authorization verification as a preliminary action before the actual API invocation. By obtaining user consent and verifying authorization in advance, the system minimizes the time added to the critical API processing path, thus reducing the perceived processing time impact while still preventing information leakage.
Data Source
Figure 1a~1b
Figure 2~4
Figure 5
AI summary
This application provides a method and system for invoking an API, and an apparatus. The method includes: An application programming interface API providing network element receives an API invoking request for a target application from an application server, where the API invoking request is for requesting to operate information of a terminal device, and includes a first identifier of the terminal device and an identifier of the target application on the application server side; obtains an authorization result based on the first identifier of the terminal device and the identifier of the target application on the application server side, where the authorization result indicates whether the application server is allowed to operate the information of the terminal device; and determines, based on the authorization result, whether to allow the application server to operate the information of the terminal device. According to this application, a leakage risk of the information of the terminal device can be lowered, thereby improving information security.