Intermediary Network Function for 5G Authorization Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In 5G core networks, there is a need for improved authorization mechanisms to ensure secure access to services, particularly in scenarios where network function consumers need to access data from producers, while ensuring authentication and authorization validation before data distribution, and handling changes in data sources due to mobility or other factors.
Innovation Solution
An intermediary network function, such as a Data Collection Coordination Function (DCCF), is introduced to validate authentication and authorization between network function consumers and producers, using an authorization server to manage access tokens and client credential assertions, ensuring secure data access and handling changes in data sources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an intermediary network function is introduced to validate authentication and authorization, then security and authorization are improved, but device complexity increases
Solution Approach 1:
The patent introduces an intermediary network function (DCCF - Data Collection Coordination Function) that acts as a mediator between network function consumers and producers. This intermediary validates authentication and authorization by exchanging access tokens and client credential assertions, ensuring secure data access while managing complexity centrally rather than distributing it throughout the network.
Solution Approach 2:
The authorization validation logic is extracted from individual network function interactions and consolidated into a dedicated intermediary function. By taking out the authentication and authorization validation responsibilities from scattered network functions and placing them in a centralized DCCF, the system improves reliability while managing complexity through centralization.
2Reliability
If access tokens are validated before data distribution, then security is improved, but processing time increases
Solution Approach 1:
The system performs authentication and authorization validation in advance before actual data distribution occurs. The intermediary network function validates access tokens and client credential assertions preliminarily, ensuring that only authorized consumers can access data. This preliminary validation prevents security breaches while the token validation itself is optimized to minimize time loss.
3Reliability
If authentication and authorization validation is performed for each data request, then authorization accuracy is improved, but productivity decreases
Solution Approach 1:
The access token serves multiple functions: it authenticates the network function consumer, authorizes data access, and enables the intermediary to validate credentials without requiring separate validation processes for each function. This multi-functional token approach improves authorization accuracy while maintaining data access efficiency by consolidating multiple validation steps into a single token-based mechanism.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
According to an example aspect of the present invention, there is provided a method comprising, receiving, by an intermediary network function, a subscription request from a network function consumer requesting data of a network function producer, wherein the subscription request comprises a client credential assertion of the network function consumer and an access token, authorizing and authenticating, by the intermediary network function, the network function consumer upon successful validation of the access token and the client credential assertion validation and transmitting, by the intermediary network function, an access token request to an authorization server to get another access token, wherein said another access token is to be used to validate the network function consumer to access services of the network function producer, and the access token request comprises the client credential assertion of the network function consumer requesting data of the network function producer.