Authorization Module for Network Function Service Invocation Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The service-based architecture in communications systems faces poor security performance due to the ability of any network function module to invoke network function services through a shared interface, leading to potential abuse and leakage of sensitive user information.
Innovation Solution
A network function service invocation method that involves an authorization module to determine permissions based on pre-configured authorization information and issue tokens for authorized access, ensuring that only permitted network function modules can invoke specific services, thereby enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If any network function module can invoke network function service through service based interface, then the adaptability and versatility of the architecture is improved, but the security performance deteriorates due to potential service abuse
Solution Approach 1:
The patent introduces an authorization module as an intermediary between network function modules. This module receives service invocation requests, verifies authorization information, and determines whether to permit the invocation based on pre-configured authorization data. This mediator resolves the contradiction by enabling versatile service invocation while maintaining security through centralized authorization control.
Solution Approach 2:
The patent implements preliminary authorization verification before service invocation. The authorization module checks authorization information in advance of the actual service execution, determining permissions based on pre-configured authorization data. This preliminary action prevents unauthorized service abuse while maintaining the flexibility of the service-based architecture.
2Reliability
If authorization verification is implemented for network function service invocation, then the security performance is improved, but the device complexity increases due to additional authorization module and verification steps
Solution Approach 1:
The authorization module is designed to handle multiple network function service invocation requests through a unified interface. It universally applies authorization verification across different service types and network function modules, reducing the need for separate verification mechanisms for each service and thereby limiting the increase in system complexity.
3Measurement precision
If authorization information is pre-configured for each network function module, then the security control precision is improved, but the loss of information increases due to complex authorization data management
Solution Approach 1:
The patent changes the parameter representation of authorization information by using structured data formats with specific fields for service identifiers, module identifiers, and permission levels. This parameter transformation enables precise authorization control while facilitating efficient storage and retrieval, thereby reducing the management overhead and information loss.
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
This application provides a network function service invocation method, apparatus, and system. The method includes: receiving, by an authorization module, a first request message sent by a first network function module, where the first request message is used to request a permission to invoke a first network function service provided by a second network function module, and the first request message carries first information, second information, and third information; determining, by the authorization module based on the first information, the second information, and the third information, whether the first network function module has the permission to invoke the first network function service; and sending, by the authorization module, a token to the first network function module when determining that the first network function module has the permission to invoke the first network function service. According to the network function service invocation method, apparatus, and system provided in this application, security of invoking a network function service can be improved.