Nested API Consent Delegation Across CAPIF AEF Domains
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing 6G communication systems lack mechanisms to ensure resource owner consent during nested API invocations, leading to security vulnerabilities and misuse of user information, particularly when AEF entities belong to different API provider domains.
Innovation Solution
Implement methods and systems to manage user consent through a Common API Framework (CAPIF) by ensuring that first API exposing functions (AEFs) obtain delegated authorization from the CAPIF Core Function (CCF) before invoking service APIs on other AEFs, incorporating resource owner consent in the authorization process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If nested API invocations are enabled in 6G communication systems, then service functionality and connectivity are improved, but security vulnerabilities and unauthorized access risks increase due to lack of resource owner consent mechanisms
Solution Approach 1:
The patent implements preliminary action by obtaining resource owner consent before nested API invocations are executed. The authorization function retrieves consent information from the data network in advance, validates it against the API invocation request, and ensures authorization is granted prior to service execution, preventing security vulnerabilities rather than addressing them afterward
Solution Approach 2:
The patent introduces an intermediary authorization function that mediates between the API invocation request and the service execution. This authorization function acts as a mediator by validating resource owner consent information and coordinating between the first AEF, second AEF, and data network to ensure secure nested API invocations
2Reliability
If resource owner consent validation is implemented in nested API invocations, then security and unauthorized access prevention are improved, but system complexity and validation overhead increase
Solution Approach 1:
The patent applies universality by designing a multi-functional authorization function that performs multiple tasks: retrieving consent information from the data network, validating API invocation requests, checking resource owner authorization, and coordinating between different AEF entities. This consolidates security validation operations into a single versatile component, managing system complexity while maintaining comprehensive security
3Reliability
If authorization validation is performed for each nested API invocation, then unauthorized access prevention is improved, but processing time and operational overhead increase
Solution Approach 1:
The patent reduces processing time by performing preliminary action - retrieving and validating resource owner consent information before the nested API invocation chain is executed. By obtaining authorization in advance and validating it upfront, the system avoids repeated validation overhead during service execution, maintaining security while improving processing efficiency
Data Source
AI summary
The present disclosure relates to a 5G communication system or a 6G communication system for supporting higher data rates beyond a 4G communication system such as long term evolution (LTE). A method performed by a first application programming interface (API) exposing function (AEF) in a wireless communication system is provided. The method includes identifying authorization information based on a first service API invocation request; sending, to a common API framework core function (CCF), a request message to get new authorization information, the request message including the authorization information; receiving, from the CCF, a response message including the new authorization information generated by the CCF in case that the first AEF is allowed for accessing a requested service API for a second AEF; and sending, to the second AEF, a second service API invocation request including the new authorization information.