IMS Data Delivery Using Access Tokens for Non-SIM Client Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The lack of security in IMS core networks when providing services to non-SIM-based clients leads to potential fraud and security breaches, resulting in network congestion and dropped services.
Innovation Solution
Implementing token-based authentication with an authorization server to verify non-SIM-based clients, associating authentication types with access tokens, and using security parameters to control data delivery based on authentication levels, ensuring only securely authenticated clients receive sensitive data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If token-based authentication with authorization server is implemented for non-SIM-based clients, then security against fraud and unauthorized access is improved, but device complexity and authentication process complexity increase
Solution Approach 1:
The system performs authentication in advance by issuing access tokens with embedded authentication types before data delivery. The authorization server pre-validates client credentials and establishes trust relationships, so that subsequent data transactions can proceed without repeated complex authentication steps.
Solution Approach 2:
The authorization server acts as an intermediary between clients and the IMS core network. It issues access tokens that mediate authentication, allowing clients to prove their identity without directly complex interactions with the core network. The token serves as a trusted intermediary credential.
2Reliability
If security parameters are used to control data delivery based on authentication levels, then protection of sensitive data is improved, but loss of time in authentication verification increases
Solution Approach 1:
Authentication levels and security parameters are determined in advance during token issuance. The authorization server classifies clients by authentication strength and embeds this information in the access token, so that data servers can make rapid permission decisions without performing time-consuming verification of authentication strength during each data request.
Solution Approach 2:
Different security parameters are applied locally to different data items based on their sensitivity. The system assigns specific security levels to different data elements, allowing fine-grained access control where each data item can be protected according to its specific requirements rather than applying uniform authentication overhead to all data.
3Reliability
If access tokens with authentication types are transmitted to clients, then control over who receives secure data is improved, but loss of information about client authentication status increases
Solution Approach 1:
The access token contains localized authentication information specific to each client's authentication status. Rather than losing all authentication details, the system embeds the essential authentication type and level directly in the token, providing just enough information for access control decisions while maintaining security.
Solution Approach 2:
The system extracts only the essential authentication status information needed for access control from the complete authentication process and embeds it in the access token. This extraction approach maintains the necessary control information while removing unnecessary complexity and protecting sensitive authentication details that aren't needed for routine access decisions.
Data Source
AI summary
A method comprising receiving incoming data destined to a line associated with a user, determining a security parameter associated with the incoming data based on at least one of a source of the incoming data or a content of the incoming data, in which the security parameter indicates a security level of the incoming data, storing, in a second data store accessible to the data application, the incoming data in association with the security parameter, receiving a sync request for the incoming data comprising an access token indicating an authentication type associated with a second factor of authentication used to authenticate the client with an authorization server, transmitting the incoming data to the client when the client is permitted to retrieve the incoming data from a data store.