CAPIF API Invoker Authorization for Multiple Resource Owners
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authorization mechanisms in CAPIF do not support scenarios where an API invoker deployed on a UE accesses resources of multiple resource owners, lacking granular authorization for services, operations, and features across multiple resource owners.
Innovation Solution
Implementing an access token request and response mechanism that allows an API invoker to request authorization from multiple resource owners, with first information specifying the desired resources, operations, and features, and receiving a response indicating authorization results at a granular level.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If existing authorization mechanisms in CAPIF are used, then the system maintains simplicity and standardization, but it cannot support scenarios where an API invoker accesses resources of multiple resource owners with granular authorization control
Solution Approach 1:
The authorization mechanism is segmented into distinct components: access token requests containing first information (service, operation, feature, resource) and access token responses containing second information (authorization results). This segmentation allows granular authorization control for multiple resource owners while maintaining manageable system complexity through structured information exchange.
Solution Approach 2:
The patent introduces an intermediary authorization mechanism that mediates between the API invoker and multiple resource owners. The access token request/response framework acts as an intermediary layer that facilitates granular authorization control without requiring direct complex interactions between all parties, thus enhancing adaptability while controlling complexity.
2Measurement precision
If granular authorization for multiple resource owners is implemented, then precise authorization control is achieved, but the complexity of the authorization mechanism increases
Solution Approach 1:
Authorization precision is achieved through segmentation of authorization information into first information (request parameters: service, operation, feature, resource) and second information (response parameters: authorization results). This structured segmentation enables precise granular authorization control while maintaining manageable complexity through organized information exchange protocols.
Solution Approach 2:
The patent employs parameter changes by introducing specific parameters (service, operation, feature, resource) in the access token request and corresponding authorization result parameters in the response. This parameter-based approach enables precise authorization control by allowing specific aspects of resource access to be controlled independently, achieving high measurement precision without proportionally increasing overall mechanism complexity.
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
Example embodiments of the disclosure relate to methods, devices, apparatuses and computer readable storage medium for resource owner(s) authorization for an Application Programming Interface (API) invoker in Communication API Framework (CAPIF) Resource owner-aware Northbound API Access (RNAA) context. In a method, a first apparatus transmits, to a second apparatus, an access token request for authorization from one or more resource owners. The access token request comprises first information for accessing resources of the one or more resource owners, each of the one or more resource owners being different from a further resource owner associated with the first apparatus; and receive. Then, the first apparatus receives, from the second apparatus, an access token response comprising second information indicating a result of the authorization for accessing the resources of the one or more resource owners.