CAPIF API Invoker Onboarding with TLS and Credential Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The challenge lies in securely on-boarding application programming interface (API) invokers to a Common API Framework (CAPIF) Core function (CCF) server, which is crucial for accessing framework and service APIs, but existing methods lack robust security and efficiency.
Innovation Solution
A method and system for secure on-boarding of API invokers to a CAPIF core function server, involving the use of onboarding credentials, TLS sessions, and validation of symmetric key-pairs, client certificates, and OAuth 2.0 access tokens to establish a secure session and generate an API invoker profile for authorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional on-boarding methods are used for API invokers, then the process is simpler, but security is compromised
Solution Approach 1:
The patent implements preliminary action by pre-configuring on-boarding credentials in the API invoker before the actual on-boarding process. The credential configuration includes storing symmetric key-pairs, client certificates, and OAuth 2.0 access tokens in advance, which are then used during the on-boarding authentication process. This preliminary preparation enables secure authentication without adding complexity to the real-time on-boarding procedure.
2Reliability
If multiple validation methods are implemented for on-boarding credentials, then security is improved, but processing time increases
Solution Approach 1:
The patent applies partial action by implementing a hierarchical validation approach where not all credential types are validated in every on-boarding scenario. The system validates credentials based on the specific on-boarding context and requirements. For example, OAuth 2.0 access tokens are validated when applicable, symmetric key-pairs are used for mutual authentication scenarios, and client certificates are validated for high-security requirements. This selective validation reduces processing time while maintaining necessary security levels.
3Reliability
If secure session establishment with TLS is required, then data protection is improved, but system complexity increases
Solution Approach 1:
The patent implements self-service by enabling the API invoker and CCF server to automatically establish TLS-secured sessions without manual configuration. The on-boarding credentials including client certificates and symmetric key-pairs are automatically exchanged and configured during the on-boarding process, allowing the system to self-manage the secure session establishment. This automation reduces the operational complexity of TLS session management while maintaining strong data protection.
Data Source
Figure 1
Figure 2~3b
Figure 4~5
AI summary
Provided is an API invoker of performing an onboarding. The API invoker includes a transceiver and a processor coupled with the transceiver and configured to obtain, from a service provider, onboarding information including an onboarding credential and information of a CAPIF core function, establish a secure session with the CAPIF core function based on the onboarding information and control the transceiver to transmit, to the CAPIF core function, an onboard API invoker request message along with the onboarding credential and to receive an onboard API invoker response message based on a result of a validating the onboarding credential at the CAPIF core function.