5G SBA Consumer NF Authorization for Secure Notifications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In the 5G Service Based Architecture (SBA), there is a risk that notification messages are sent to unauthorized network functions (NFs) due to unverified Binding Indication or Routing Binding Indication, posing a security risk.
Innovation Solution
Implementing an access token mechanism that includes a consumer NF Set list authorized by the Network Repository Function (NRF) to ensure that notification messages are sent only to authorized receivers, using the AccessTokenClaims data structure to verify and authorize notification endpoints.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If Binding Indication or Routing Binding Indication is used to determine notification endpoints, then notification delivery flexibility is improved, but security risk increases due to potential unauthorized NF reception
Solution Approach 1:
The patent introduces an access token as an intermediary mechanism between the service producer NF and the notification endpoint. The access token is issued by the NRF after verifying the consumer NF's authorization, and it contains the authorized notification endpoint information. This intermediary token mechanism allows flexible notification delivery while ensuring security by verifying authorization before allowing any notification to be sent.
Solution Approach 2:
The patent implements preliminary authorization verification before notification delivery. The service consumer NF must first obtain an access token from the NRF by providing proof of authorization. The NRF verifies the consumer NF's authorization status before issuing the access token. This preliminary action ensures that only authorized consumers can receive notifications, preventing unauthorized reception while maintaining delivery flexibility.
2Object-affected harmful factors
If access token mechanism with verification is implemented, then security is improved, but device complexity increases
Solution Approach 1:
The access token serves multiple functions simultaneously: it acts as an authorization credential, contains the notification endpoint information, and provides the verification mechanism. By combining these multiple functions into a single token structure, the patent reduces the need for separate verification mechanisms, authorization structures, and endpoint management systems, thereby limiting the increase in system complexity.
Solution Approach 2:
The service consumer NF is responsible for obtaining the access token and using it to receive notifications. The service producer NF simply needs to verify the access token and send notifications to the endpoint specified in the token. The NRF automatically verifies authorization and issues tokens. This self-service approach distributes the complexity management across the system components, reducing the burden on any single component.
Data Source
AI summary
Embodiments include methods performed by a service consumer network function (NF) of a communication network. Such methods include sending, to a network repository function (NRF) of the communication network, a request for an access token for notifications from a service producer NF of the communication network. The request includes a list of alternative notification endpoints. Such methods also include receiving, from the NRF, an access token for the notifications from the service producer NF. The access token includes the list of alternative notification endpoints. Such methods also include sending, to the service producer NF, a subscription request for the notifications. The subscription request includes the received access token, a primary notification endpoint, and binding information usable for selecting an alternative notification endpoint from the list. Other embodiments include complementary methods performed by NRFs and service producer NFs, as well as network nodes/functions that perform such methods.