Network Function Service Subscription Control via Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network function service subscription and provision mechanisms in communication networks face challenges in validating notification addresses and ensuring data reception authorization, leading to potential security issues and denial-of-service attacks.
Innovation Solution
A new service, referred to as the receiving data authorization service, is introduced to validate notification addresses and confirm data reception authorization before sending notifications from a service-consuming NFc to a service-receiving NFc2, using access tokens and authorization requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If network function service subscription and provision mechanisms are implemented without validation, then service provisioning speed is improved, but security is worsened leading to potential denial-of-service attacks
Solution Approach 1:
The patent applies preliminary action by implementing notification address validation and authorization checks before the actual service subscription and data delivery processes. The NFc2 is pre-authorized to receive notifications, and the NFp validates the notification address before sending data, preventing unauthorized access and denial-of-service attacks while maintaining efficient service provisioning.
2Reliability
If notification address validation and authorization checks are implemented, then security is improved, but system complexity is worsened
Solution Approach 1:
The patent uses the NFc (intermediary) to facilitate authorization between NFp and NFc2. The NFc obtains authorization from NFc2 and relays it to NFp, enabling secure notification delivery without requiring direct complex validation logic in each component. This intermediary approach simplifies the overall system architecture while maintaining security.
3Reliability
If access tokens and authorization requests are used for each notification, then data reception authorization is improved, but processing time is worsened
Solution Approach 1:
The patent implements preliminary authorization where NFc2 provides authorization information to NFc in advance, and NFc stores this authorization. When NFp needs to send notifications, it validates against the pre-stored authorization information rather than performing full authorization checks for each notification, significantly reducing processing time while maintaining security.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
According to an example aspect, there is provided a method, comprising: receiving, from a first network function consumer, a subscribe request for a second network function consumer to subscribe to a service, wherein the subscribe request comprises a notification address and identifies the second network function consumer, transmitting, to a network repository function, an access token request, comprising the notification address and identifying the second network function consumer, receiving, from the network repository function, an access token response comprising an access token comprising the notification address verified by the network repository function, transmitting, to the second network function consumer, an authorization request for receiving data authorization and comprising the access token, receiving, from the second network function consumer, an authorization response indicative of authorization of the second network function consumer, and transmitting, on the basis of the authorization response, a notification to the second network function consumer.