CAPIF API Invoker Authorization for Multi-Owner Resource Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authorization mechanisms in CAPIF do not support API invokers deployed on a UE to access resources of multiple resource owners in a single token request, limiting access to only the UE's own resources, and lack granular authorization for services, operations, and features across multiple resource owners.
Innovation Solution
Implementing an access token request and response system that allows an API invoker to request authorization from multiple resource owners, including specific services, operations, and features, with enhanced scope parameters to enable granular access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If existing authorization mechanisms in CAPIF are used, then the API invoker can access resources with simple authorization, but the API invoker is limited to accessing only the UE's own resources and cannot access resources of multiple resource owners
Solution Approach 1:
The patent segments the authorization scope by introducing distinct scope parameters for different resource owners. Each resource owner's resources are accessed through separate scope declarations in the access token request, allowing the API invoker to request authorization for multiple resource owners independently. This segmentation enables versatile access to multiple resource owners while maintaining manageable authorization complexity through structured scope parameters.
2Measurement precision
If authorization for multiple resource owners is enabled, then granular access control is achieved, but the authorization request and response structure becomes more complex
Solution Approach 1:
The patent adds a new dimension to the authorization structure by introducing scope parameters that include resource owner identifiers, service identifiers, operation identifiers, and feature identifiers. This multi-dimensional scope parameter structure enables granular authorization control across multiple resource owners, services, operations, and features simultaneously, transforming the flat authorization model into a hierarchical multi-dimensional one that provides precise control without excessive structural complexity.
3Adaptability or versatility
If the API invoker requests access to multiple resource owners' resources, then resource access flexibility is improved, but the number of authorization requests and processing overhead increases
Solution Approach 1:
The patent merges multiple authorization requests into a single access token request by allowing the scope parameter to include multiple resource owner identifiers, service identifiers, operation identifiers, and feature identifiers simultaneously. The network device processes all these scope declarations in one authorization evaluation and returns a single access token that encompasses all requested permissions. This merging approach maintains high resource access flexibility while significantly reducing authorization processing time by eliminating the need for multiple separate authorization requests.
Data Source
AI summary
Example embodiments of the disclosure relate to methods, devices, apparatuses and computer readable storage medium for resource owner(s) authorization for an Application Programming Interface (API) invoker in Communication API Framework (CAPIF) Resource owner-aware Northbound API Access (RNAA) context. In a method, a first apparatus transmits, to a second apparatus, an access token request for authorization from one or more resource owners. The access token request comprises first information for accessing resources of the one or more resource owners, each of the one or more resource owners being different from a further resource owner associated with the first apparatus; and receive. Then, the first apparatus receives, from the second apparatus, an access token response comprising second information indicating a result of the authorization for accessing the resources of the one or more resource owners.