Delegated Access Token Verification in 5G Service Communication Proxies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing 5G Service-Based Architecture (SBA) faces challenges in ensuring secure token verification for network function (NF) access, as service communication proxies (SCPs) may not be authorized to verify access tokens on behalf of NFs, leading to uncertainties and potential unauthorized service provision without effective validation.
Innovation Solution
Implementing a system where service communication proxies (SCPs) receive tokens generated by a network repository function (NRF) based on registration information from NFs, verifying the tokens only if they belong to a delegated domain list, ensuring mutual trust and secure access token verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If service communication proxies verify access tokens without authorization checks, then service access speed is improved, but security and reliability deteriorate due to unauthorized service provision
Solution Approach 1:
The patent applies preliminary action by having network functions pre-register their delegation domain lists with the network repository function before actual service access. This allows service communication proxies to perform fast local verification against the pre-stored delegation domain lists without needing real-time authorization checks, thus maintaining both high service access speed and secure token verification.
2Reliability
If strict authorization verification is performed for token verification, then security is improved, but system complexity increases due to additional verification steps
Solution Approach 1:
The patent extracts the authorization verification logic from the service communication proxies and centralizes it in the network repository function. The NRF stores and manages the delegation domain lists, while SCPs only perform simple membership checks against these pre-provided lists. This separation reduces the complexity of individual verification components while maintaining overall system security.
3Reliability
If delegation domain lists are implemented for token verification, then authorization control is improved, but information processing complexity increases due to list management
Solution Approach 1:
The patent introduces the network repository function as an intermediary that manages the delegation domain lists. Instead of having each service communication proxy independently manage authorization data, the NRF acts as a central mediator that stores, updates, and provides delegation domain lists to SCPs. This intermediary approach simplifies list management while maintaining strong authorization control.
Data Source
AI summary
Example embodiments of the present disclosure relate to access token verification. In example embodiments, a method is provided. The method comprises, at a first service communication proxy, receiving, from a second service communication proxy, a first request for a service from a first network function, the first request originating from a second network function and comprising a token to access the first network function, the token comprising a delegation domain list to which token verification is delegated by the first network function, the token being generated by a network repository function based on registration information from the first network function, the registration information comprising at least one of: an indication of whether a delegation of the token verification is allowed or the delegation domain list: alternatively the first service communication proxy may obtain whether a delegation of the token verification is allowed and the delegation domain list from the network repository function and in accordance with a determination that the first service communication proxy belongs to the delegation domain list, verifying the token. In this way, the verification of the access token can be improved.